Senior AI Information Security Engineer

Description

The company is an exposure management firm. More than 40,000 organizations worldwide use its products to understand and reduce cyber risk, including 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies.

The team builds and ships cybersecurity products and works in a collaborative culture focused on belonging, respect, and excellence, with a strong emphasis on delivering results together.

The role sits within the Information Security team and focuses on securing AI, both inside the company's products and across the enterprise. AI brings new risk where application security, cloud risk, and data governance meet, and this person helps define how that risk is assessed, tested, and handled.

Responsibilities

• Design and run security controls across the full AI and ML lifecycle.
• Lead safety research by examining model internals to find hidden deception, latent knowledge, or unwanted concepts across layers.
• Carry out AI safety and security assessments and threat models, covering data poisoning, model evasion, model extraction, adversarial inputs, and integrity attacks.
• Build guardrails, controls, and boundary mechanisms for LLMs, SLMs, and open-source models.
• Serve as the subject matter expert on AI safety research, using model internals to detect hidden deception, latent knowledge, or unwanted concepts so outputs stay transparent and aligned.
• Track new AI vulnerabilities and attack methods and act early to protect enterprise AI deployments.
• Create security reference architectures for AI deployment patterns, including MCP servers and agentic AI workflows and harnesses.
• Set up controls for model integrity, governance, and access across models and feature stores.
• Build AI-driven tools that improve security across identity, incident management, vulnerability management, third-party risk, and emerging AI threats.
• Work with software engineers and product teams to build security into AI development, training, validation, and deployment.
• Lead SSDLC and DevSecOps work for AI products, covering threat modeling, security testing, penetration testing, and CI/CD pipeline security automation.
• Write security guidance, documentation, and training for engineering teams, and define metrics that encourage secure behavior.
• Research emerging AI security trends and propose solutions that support the company's AI initiatives.

Requirements

• At least 5 years of professional experience in information security or application security, including at least 1 to 2 years securing AI or ML systems.
• A master's degree in computer science, cybersecurity, data science, or a related field is preferred.
• Deep knowledge of AI-specific threats such as adversarial ML, data poisoning, prompt injection, model inversion, model evasion, and inference attacks.
• Strong coding skills in Python, Go, or both.
• Experience with frameworks and libraries such as PyTorch, Hugging Face Transformers, TensorFlow, or similar.
• Experience with interpretability and probing tools such as TransformerLens, NNsight, Captum, or LIT (Learning Interpretability Tool).
• Familiarity with mechanistic concepts such as inspecting internal model states, residual streams, attention patterns, activation steering, Sparse Autoencoders (SAEs), or feature attribution.
• Solid understanding of the ML and AI lifecycle and the security risks at each stage.
• Knowledge of AWS, Azure, or GCP security, including their AI and ML services.
• Knowledge of data security principles, including encryption, masking, and tokenization.
• Knowledge of SSDLC, DevSecOps, and security testing, including SAST, DAST, SCA, and threat modeling.
• Knowledge of application security architecture, including modern web applications, Docker, and microservices.
• Ability to work across engineering, product, and business teams.
• Strong written and verbal communication, with the ability to explain complex AI security risks to technical and non-technical audiences.
• Strong problem-solving skills, attention to detail, and the ability to own projects end to end.
• Self-motivated and able to work independently and across distributed teams.
• Ideally, hands-on experience with AI red teaming, adversarial prompt testing, or LLM security assessments.
• Ideally, familiarity with AI security frameworks and standards such as the OWASP LLM Top 10 and the NIST AI Risk Management Framework.
• Ideally, experience with application security assessment tools such as Burp Suite, ZAP, or the company WAS.
• Ideally, familiarity with AI governance frameworks such as the EU AI Act and NIST AI RMF.
• Ideally, background in cloud security or large-scale SaaS environments.
• Security certifications such as CISSP, CSSLP, SANS GIAC, CEH, or AI-focused security certifications are a plus but not required.

Conditions

Hybrid work.

You must be authorized to work for any U.S. employer without sponsorship. The company cannot sponsor work visas of any kind, at hire or at any later point, including F1-OPT, F1-CPT, H-1B, TN, and J-1.

Base pay range is $122,500 to $163,166.67 USD. Final pay depends on qualifications, skills, competencies, location, and experience, and may fall outside this range.

The company is an equal opportunity employer and considers applicants without regard to protected characteristics.

Benefits

• Eligible for variable pay as a bonus based on company and individual performance, in addition to base pay.
• Medical, dental, and vision coverage, disability and life insurance, and flexible spending accounts.
• 401(k) with company match and an employee stock purchase plan.
• Employee referral program, Employee Assistance Program, and education assistance.
• Parental leave, paid time off, company-paid holidays, health and wellness events, and community programs.