Anomali, headquartered in Silicon Valley, delivers the first Intelligence-Native Agentic SOC Platform — unifying a security data lake, the world's largest IOC repository, threat intelligence, and agentic AI into a single modern experience. The platform accelerates detection, investigation, and response, delivering earlier insights, faster action, and scalable modernization across any environment.

Whether augmenting existing tools or delivering complete SOC capabilities end-to-end, Anomali empowers security teams to operate faster, smarter, and with confidence.

Beyond Detecting. Start Deciding. Start Acting.

Learn more at www.anomali.com

The Senior AI Product Architect is a senior technical leader within the Product organization responsible for defining the AI, data, and platform architecture that powers Anomali’s product strategy and for leading the technical execution of strategic AI-driven initiatives.

This role will help advance Anomali’s architecture thesis around the Intelligent Unification Layer, including the Governed Decisioning Layer, which provides the trusted data, context, governance, auditability, and control required for AI-driven security operations. The architecture supports Anomali’s two primary product experiences:

• Agentic SOC Platform
• Managed Intelligence as a Service — MIaaS

The Senior AI Product Architect will ensure that technical decisions support Anomali’s five-level maturity model, enabling customers to progress from intelligence-enriched security operations through increasingly advanced levels of data unification, correlation, decisioning, automation, and agentic security operations.

Working closely with Product Management, Engineering, Data Science, UX, Product Marketing, and executive leadership, this role translates product doctrine and strategy into scalable technical architecture and executable implementation plans.

Engineering retains responsibility for people leadership, software delivery, and operational execution. The Senior AI Product Architect provides day-to-day technical leadership for engineers assigned to strategic initiatives, owns architectural integrity, and guides technical decisions across the product portfolio.

The successful candidate brings deep expertise in the following areas:

1. Enterprise AI and agentic platform architecture
2. Large-scale data and platform architecture supporting AI and cybersecurity workloads
3. Technical product leadership, including translating product strategy into executable architecture

The candidate should also be conversant in adjacent disciplines, including distributed search, retrieval-augmented generation, machine learning operations, streaming data infrastructure, and executive customer engagement. Deep specialization in every adjacent area is not required.

Product and Architecture Leadership

• Define the technical architecture supporting Anomali’s Intelligent Unification Layer, Governed Decisioning Layer, Agentic SOC Platform, and MIaaS.
• Translate product strategy, customer outcomes, and business requirements into scalable architecture and implementation plans.
• Balance near-term delivery requirements with long-term scalability, maintainability, interoperability, and governance.
• Ensure architecture decisions align with Anomali’s five-level maturity model and support customers at different stages of adoption.
• Own the technical execution strategy for assigned product initiatives.
• Ensure new capabilities align with Anomali’s long-term AI, data, intelligence, and platform vision.
• Lead architecture reviews and approve technical designs for strategic product initiatives.
• Establish architectural principles, engineering standards, and reusable platform patterns.
• Ensure consistency across platform services, APIs, AI models, data services, shared services, and distributed infrastructure.

Product Management Partnership

• Partner closely with our Head of Field Product (International), Satya Roy, on field doctrine - customer adoption requirements, use cases, and the application of the five-level maturity model.
• Partner closely with Senior Principal Product Manager, Patrick Holt, on product roadmap sequencing, platform evolution, and capability delivery.
• Jointly evaluate architectural trade-offs, feasibility, sequencing, and dependencies with Product Management before commitments are made.
• Clearly distinguish between:
• Capabilities available today
• Capabilities dependent on customer deployment posture or maturity level
• Future roadmap capabilities
• Ensure technical architecture remains aligned with approved product doctrine and customer-facing positioning.
• Any unresolved disagreements between Architecture, Engineering, and Product Management will be escalated to the Head of Product and Engineering, who will make the final decision in consultation with executive leadership, as appropriate.

AI and Agentic Architecture

• Define the long-term architecture for AI-driven and agentic security operations.
• Design agent orchestration frameworks, reasoning pipelines, contextual decision systems, AI-assisted workflows, and human-in-the-loop controls.
• Architect the Governed Decisioning Layer to support appropriate authorization, traceability, auditability, explainability, rollback, and policy enforcement.
• Define architectural patterns that allow agents to operate against unified, normalized, deduplicated, and contextualized security data.
• Ensure autonomous and semi-autonomous workflows operate within clearly defined risk, identity, permission, and governance boundaries.
• Support the evolution from assisted investigation and decision support toward increasingly advanced agentic operations as product capabilities and customer readiness mature.
• Evaluate emerging foundation models, agent frameworks, AI infrastructure, and security technologies for potential strategic adoption.

Data and Platform Architecture

• Architect large-scale enterprise data platforms supporting AI, analytics, operationalized intelligence, and cybersecurity workloads.
• Define architecture for high-volume ingestion of telemetry, threat intelligence, identity, cloud, endpoint, network, and other security data.
• Design scalable data normalization, enrichment, deduplication, correlation, storage, and retrieval services.
• Ensure data entering the platform is governed, observable, attributable, and suitable for machine-speed analysis and decisioning.
• Define trusted data foundations through governance, lineage, provenance, data quality, access control, and lifecycle management.
• Architect petabyte-scale storage and processing patterns using modern distributed data technologies and open table formats where appropriate.
• Optimize architecture for performance, resiliency, cost efficiency, sovereignty, and customer-controlled deployment requirements.
• Architect solutions supporting cloud, regional VPC, sovereign cloud, on-premises, and hybrid deployment models as required by customer and product strategy.

Search, Retrieval, and Context Engineering

• Provide architectural direction for distributed search and low-latency retrieval across large security datasets.
• Guide the use of vector databases, semantic search, hybrid search, embeddings, retrieval-augmented generation, and relevance optimization where appropriate.
• Ensure AI systems have access to the operationalized intelligence, environmental context, identity context, and historical evidence required to produce trusted outcomes.
• Partner with engineering specialists to optimize indexing, query performance, throughput, and retrieval quality.
• Maintain sufficient technical depth to assess design quality and trade-offs without requiring the role to personally own every search or retrieval subsystem.

AI Engineering and Data Science Partnership

• Partner with Data Science and AI Engineering teams to operationalize models and AI capabilities into scalable production systems.
• Define platform architecture supporting inference, model lifecycle management, feature engineering, evaluation, observability, and continuous improvement.
• Ensure AI capabilities are built on trusted, governed, and high-quality data.
• Establish standards for model and agent evaluation, including accuracy, safety, traceability, resilience, and business outcomes.
• Guide the integration of predictive, generative, and agentic capabilities into the broader product platform.

Cross-Functional Delivery

• Lead the technical direction of cross-functional delivery teams comprising Product Managers, AI Engineers, Software Engineers, Data Engineers, UX, QA, DevCloudOps, and other specialists.
• Provide day-to-day technical leadership throughout the software development lifecycle.
• Work with Engineering Managers to align resources, dependencies, technical priorities, and delivery sequencing.
• Remove architectural and technical blockers that threaten strategic initiatives.
• Guide implementation decisions while preserving Engineering’s ownership of execution and operational delivery.
• Ensure technical commitments are realistic, clearly scoped, and consistent with the approved roadmap.
• Maintain architectural documentation, decision records, and clear technical accountability.

Customer and Executive Engagement

• Participate in strategic customer engagements to understand technical requirements, deployment constraints, security posture, and desired business outcomes.
• Represent Anomali’s architecture thesis with executive customers, strategic partners, analysts, and other external stakeholders.
• Clearly explain the evolution from traditional SIEM and threat intelligence operating models toward AI-driven security operations powered by the Intelligent Unification Layer.
• Communicate how Anomali can augment an existing security architecture across Levels 1–4 and support broader platform transformation at Level 5 when the customer is ready.
• Avoid positioning roadmap capabilities as currently available and ensure all external technical discussions remain aligned with approved Product messaging.
• Present technical strategy, architecture, trade-offs, and product direction to executive leadership.

Platform Innovation and Technical Excellence

• Drive the architectural evolution of AI-native platform capabilities.
• Champion reusable engineering services, common platform components, and architectural modernization.
• Reduce technical debt through disciplined architecture planning and prioritization.
• Continuously improve platform scalability, performance, resiliency, security, and operational efficiency.
• Mentor architects, engineers, and technical leaders across the organization.
• Promote clear technical decision-making, accountability, and documentation.

Security & Privacy Responsibilities

• This role includes responsibilities related to the security and privacy of Anomali's information systems and data across corporate and cloud environments.  Access to systems and data is granted based on role requirements, and individuals are expected to comply with Anomali security and privacy policies, complete required training, and safeguard sensitive company and customer information in accordance with the applicable security standards and regulatory requirements.

Candidates should be able to evaluate architecture and guide specialists across:

• Data lake and lakehouse technologies
• Petabyte-scale storage and data lifecycle management
• Distributed search and low-latency retrieval
• Vector databases and semantic search
• Retrieval-augmented generation
• Embeddings, hybrid retrieval, and relevance optimization
• Machine learning operations and model lifecycle management
• Feature engineering and inference pipelines
• Kubernetes and cloud-native infrastructure
• On-premises, sovereign, regional VPC, and customer-controlled deployment models

Deep hands-on specialization in every area above is not required.

• Strong understanding of enterprise cybersecurity platforms and operating models.
• Experience with one or more of the following:
• Security Information and Event Management
• Threat Intelligence
• Security analytics
• XDR
• SOAR
• Identity and non-human identity
• Observability
• AI-driven security operations
• Ability to understand and communicate:
• Operationalized intelligence
• Governed decisioning
• Human-in-the-loop AI
• Customer maturity and adoption models
• Security data unification
• SIEM augmentation and modernization
• Agentic security operations