AI Security Engineer/Developer

We are seeking an experienced, hands-on, AI Security engineer / developer, to support our Enterprise AI Security Program. Our AI landscape spans everything from internal chatbot pilot to a full agentic workflow with tool access, Code Assistant rollout to thousands of developers to new Agentic platform. Externally, the tools and protocols worth worrying about change every few months. You'll be the person who can look at both ends of that spread ensuring safe and secure adoption of AI.

• Strong SWE, with 5+ years of experience; proficiency in Python (or equivalent) 3+ years in AI/ML or GenAI security (prompt injection defense, unsafe output handling, tool-use abuse, data leakage), or equivalent hands-on infosec experience with a demonstrated pivot into AI security.
• Demonstrated ability to write security policy that is specific and testable, and to translate it into automated enforcement (policy-as-code, CI/CD gates, gateway-level controls, DLP rules) rather than a document that relies on voluntary compliance.
• A track record of self-directed learning on fast-moving technical topics — comfortable digging into how a brand-new tool, protocol, or framework actually works (architecture, trust boundaries, auth model) well enough to give a defensible security opinion on it within days, not months.
• Working knowledge of AI/LLM security risks: prompt injection, jailbreaking, unsafe outputs, tool-use abuse, identity misuse, agentic workflow escalation.
• Hands-on familiarity with AI security frameworks: NIST AI RMF, MITRE ATLAS, OWASP LLM Top 10 / OWASP Agentic Top 10.
• Experience with cloud security across at least two of AWS, GCP, and Azure, including native AI/ML security tooling (Bedrock Guardrails, Vertex AI floor settings, Azure AI Content Safety).
• Identity and access management fundamentals — OAuth 2.0/2.1, OIDC, mTLS — with interest in or exposure to non-human/workload identity (SPIFFE/SPIRE) and agent identity models.
• Experience in a highly regulated industry (healthcare, financial services) with HIPAA or equivalent compliance obligations.
• Strong technical writing — you can turn a vendor capability gap or a new tool's risk profile into a control requirement someone else can implement and test.