Security AI Operations Engineer

About Thales

Location and work arrangement

• The role is based in Belfast, Northern Ireland, and is described as hybrid.

Role overview

Responsibilities

• Review AI alert enrichments, threat summaries and triage recommendations; assign and track investigations, policy changes and incident-response playbooks.
• Escalate pipeline exceptions and integration errors; curate runbooks, SOPs, threat intelligence and product documentation in Amazon Bedrock Knowledge Bases and Amazon OpenSearch Service.
• Audit AI retrieval and generated outputs, document knowledge gaps, identify hallucinations and false positives, and collaborate on guardrails and evaluation datasets.
• Maintain prompts and templates, submitting engineering tickets when code changes are required; track MTTR, assignment velocity and analyst AI adoption.
• Train security and services teams on prompts, AI copilots and feedback workflows; gather practitioner feedback for the engineering roadmap.
• Support Sales Engineering proofs of value and account-team efforts to improve customer adoption, retention and renewals.

Required qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering or a related field; a master's degree is a plus.
• 3–5+ years in SOC, MSSP, ITSM or technical workflow coordination, including 2+ years with AI- or generative-AI-enabled tools or workflows.
• Working knowledge of security operations, threat lifecycle, alert triage, WAF, API security and frameworks such as MITRE ATT&CK or NIST.
• Practical generative AI, prompt workflow and enterprise ticketing/orchestration experience; examples include Jira, ServiceNow, PagerDuty or SOAR.
• Comfort with AWS Management Console, especially Amazon Bedrock, OpenSearch Dashboards and CloudWatch metrics.
• Strong technical writing and experience authoring security runbooks, SOPs and structured process documentation.

Preferred qualifications

• Basic Python scripting or experience writing OpenSearch/Elasticsearch queries, SQL or Lucene queries is preferred.
• The description is truncated during the preferred qualifications section; additional qualifications may be missing.