Agentic Incident Responder

Profero seeks an Agentic Incident Responder for our global IR team. This senior practitioner role steers and drives agentic systems during live cyber incidents. The agents do the reasoning and the tool calls. This person decides what they run against, with what authority, under which guardrails, and when a human has to take over. You will drive the agentic capabilities of Rapid-IR, our incident response platform, working with Deep Breach Focus, the in-house model built from our own casework. It is not a prompt-engineering or ML-research role.

Core Responsibilities

• Steer agentic systems during live cyber incidents, deciding what they run against and with what authority
• Constrain an agent’s tool scope and permissions, and prove it stayed inside them
• Apply the 12-question triage checklist in the first minutes to classify an incident as human, agent, or ambiguous
• Run Absence Analysis to detect adversarial TTPs that should be present but are missing
• Run Presence Analysis to identify artifacts attackers never produce, such as written confessions or optimization rationale
• Collect agent-specific evidence from minute one: action logs, tool-call records, planning traces, and session context alongside endpoint and network telemetry
• Defend against attacker-controlled content injected into an agent’s context through poisoned retrieved data
• Detect and contain runaway or cascading agent behavior before it spreads beyond the original incident scope
• Stop an agent and take over manually when autonomous action exceeds authorized boundaries
• Write defensible attribution and reporting for insurers, boards, and regulators when the chain of causation is genuinely ambiguous

Required Qualifications

• 5+ years in Incident Response or Digital Forensics and Incident Response (DFIR), with a record of managing high-pressure investigations
• Hands-on operation of LLM-based agents in production: tool calling, planning loops, memory, and multi-agent orchestration
• Experience defining autonomy levels and approval gates that keep agent actions inside authorized boundaries
• Prompt and context engineering under incident pressure, including sanitizing untrusted content before it reaches an agent
• Forensics fundamentals across Windows, Linux/Unix, and macOS artifacts, network and cloud evidence, and large-scale log analysis
• Scripting or automation (Python, APIs) to read agent logs and build guardrails
• Working knowledge of the OWASP Top 10 for Agentic Applications, from goal hijacking to tool misuse
• Judgment to halt an agent mid-task and continue the investigation manually
• Experience briefing insurers, boards, and regulators on incidents with ambiguous causation
• Strong technical writing for both technical and executive audiences
• Fluent English (written and verbal)
• Remote collaboration competence and on-call availability, including non-standard hours

Preferred Qualifications

• Experience building agent guardrails or evaluation harnesses
• Red-teaming experience with agents for prompt injection or tool misuse
• Cloud identity administration experience (Entra ID, Okta)
• Incident command or war-room leadership during active breaches
• Mentoring experience with junior and mid-level IR analysts

Benefits

• Fully remote employment
• Exposure to significant real-world agentic and traditional incidents
• Professional development opportunities
• Technical leadership pathways
• Flexible time off and schedule accommodation

Contact

To apply, send your resume to careers@profero.io