AI-Augmented Security Operations & Automation

• Design and deploy AI-assisted investigation workflows that leverage LLMs and automated agents to accelerate triage, context enrichment, and threat containment.
• Build and extend internal security tooling to support identity resolution, cross-source log correlation, and natural-language querying over security telemetry.
• Automate the handoff between detection tooling and our ticketing system so investigations move from alert to resolution with minimal manual work.

Incident Response & Investigations

• Lead and support security investigations end-to-end, from initial triage through containment and resolution.
• Mentor Security Operations team members and set the standards the team builds against, including rule quality, detection-as-code practices, and investigation rigor.
• Partner with relevant teams across the business to investigate and remediate security escalations surfaced from Customer Support, Customer Delivery, and internal teams.
• Maintain and improve response playbooks based on lessons learned from real investigations.
• Participate in an on-call rotation to respond to security incidents outside business hours.

AI Defensive Testing & Validation

• Threat model new and existing systems, including AI agents and services, to identify what could go wrong, what we would need to see to catch it, and how we would respond.
• Lead defensive testing, purple-teaming, and adversarial validation exercises to test alert fidelity and evaluate detection resilience against AI-driven threats.
• Partner with Platform and Engineering teams to ensure new AI services and features expose necessary logging and telemetry for effective security monitoring.
• Evaluate authorization and access-control changes for security-relevant blast radius, and drive remediation with the engineering teams that own the affected systems.

Threat Intelligence

• Operationalize threat intelligence into actionable detections and tracked follow-up work.
• Coordinate indicator of compromise (IOC) blocking across endpoint, network, and web layers.

What You Bring to the Table

• 8+ years of experience in detection engineering, incident response, or security engineering, with demonstrated leadership in shaping organizational security strategy.
• Practical experience incorporating AI tooling into SecOps workflows, along with familiarity with detection strategies for AI-specific threat vectors.
• Strong scripting/automation skills (Python, JavaScript, or similar) and experience building workflows in a SOAR-style or workflow automation platform.
• Experience managing security controls as code (e.g., Terraform), with changes made through peer review rather than manual console changes.
• Experience securing cloud environments (AWS preferred) and modern SaaS/identity stacks.
• Hands-on incident response experience: triage, investigation, containment, and postmortem/playbook development.
• Working knowledge of adversary tradecraft (MITRE ATT&CK) and the ability to translate it into practical, tuned detections rather than noisy alerts.
• Proven ability to partner directly with engineering and infrastructure teams to define telemetry and control requirements for systems you don't own.
• Excellent written communication. This role regularly turns investigation findings into clear, factual updates for technical and non-technical stakeholders alike.

Bonus if You Have

• Experience contributing to or building from open detection content, such as Sigma rules or community rule repos.
• Experience collaborating with red/purple-team exercises to validate detection coverage.
• Experience supporting a healthcare, regulated, or otherwise highly sensitive-data environment.
• Relevant certifications (GCIH, GCFA, GCTI, GCDA, or equivalent practical experience).

What we can offer you:

Why Fullscript

Great work happens when people feel supported, trusted, and inspired. At Fullscript, we stay curious and keep finding smarter ways to make care better. We grow together, take on new challenges, and focus on impact. We put people first, work as a team, and leave egos at the door.

What to Know Before You Apply

We’re grateful for the interest in joining Fullscript. To make sure your application reaches our hiring team, please apply directly through our careers page.

A quick note:

Due to the high volume of applications, we’re not able to respond to phone or email inquiries about application status. If there’s a match, our team will reach out directly.

Fullscript is an equal opportunity employer committed to creating an inclusive workplace. Accommodations are available upon request at [email protected].

All offers are contingent on successful background checks conducted in compliance with federal, state, and provincial laws.

We use AI tools to support parts of the hiring process, including screening and reviewing responses. Final hiring decisions are always made by people and follow all applicable privacy and employment laws in Canada and the U.S.

Learn More

www.fullscript.com

@fullscriptHQ

on instagram

Let’s make healthcare whole