Staff Security Engineer, AI

Description

The company is a venture-backed AI startup in compensation. It builds AI-forward tools and engineering to make pay competitive and fair.

It runs a live compensation data platform for enterprise teams, helping large companies make pay decisions that are fair, competitive and compliant.

The team is built around live data and careful design. Its products are trusted by some of the world's largest companies, including NVIDIA, Stripe, DoorDash, OpenAI, Moderna, Workday, Ulta and Target.

Responsibilities

• The company is AI-first and applies its enterprise customers' security standard to its own AI use. Teams are already using agents and AI tools, and doing this securely at enterprise scale has no settled playbook yet. This role helps write it.
• As a senior member of the Security team, you report directly to the Head of Security and IT. You will build the identity, access, data, endpoint and network foundation that lets people and agents use AI safely. Most near- and mid-term work goes into this foundation, which also strengthens the wider security program.
• You are a security engineer first. You start from threats, identity and trust boundaries before choosing tools, and you judge success by what ships. You also make the secure option the easiest one to use. Push back when needed, but come with a secure path to the goal rather than a plain no.
• Design and build the shared AI security architecture across identity, data, endpoint, SaaS and network. Turn it into policy, standards and reference architectures so new tools follow a standard path instead of a one-off review.
• Make approved AI tools the fast route, so every team can adopt them quickly.
• Own each request from start to finish. Clarify vague asks into clear requirements, then design, build and run the solution in production with IT, engineering, legal, privacy and business leaders.
• Define how agents, service accounts and integrations authenticate and what they may do. Use scoped credentials, OAuth scope governance and least privilege, and add human approval for consequential actions.
• Control how internal data reaches models and agents and how it leaves them. Cover classification, permission-aware retrieval, AI gateways with DLP, MCP and tool allowlisting and egress controls. Assess third-party models and AI vendors for security, data retention and training use.
• Map attack paths for new models, agents and integrations, including prompt injection, unsafe tool use, OAuth abuse and data exfiltration. Decide where to add friction or refuse, and record the residual risk.
• Build audit logs of prompts, tool calls and agent actions, and detections for unusual tool use and unexpected data movement. Automate enforcement so secure settings scale and stay the default.
• Contribute to cross-functional security work across identity, endpoint, SaaS, cloud, network, detection and incident response.

Requirements

• Substantial hands-on security engineering experience, with strong fundamentals and a security and privacy first mindset.
• Experience designing, building or securing AI systems or integrations, such as agents, tool use, retrieval over internal data or MCP. You understand how they are attacked, including prompt injection, data leakage and excessive agency.
• Deep experience with identity and access architecture: SSO and federation (SAML, OIDC), conditional access and MFA, privileged access, identity lifecycle, non-human identities and OAuth consent and scopes.
• Hands-on experience securing endpoints and SaaS, including device management across major operating systems, device posture in access decisions, SaaS admin controls, third-party integrations and audit logging.
• Strong cloud and network security fundamentals, including cloud IAM, segmentation and egress control.
• A working understanding of adversary TTPs and attack paths across identity, endpoint, cloud and SaaS.
• You build for default security rather than relying on instructions. You would push an MDM policy instead of writing a how-to, write code to automate repeated work, and keep configurations and agent skills version controlled in a repo.
• Staff-level judgment: you work from requirements to architecture before choosing tools, turn new problems into concrete plans, and explain trade-offs and residual risk to technical and non-technical audiences at every level.
• Plus: hands-on experience deploying AI security controls such as MCP gateways, LLM proxies or sandboxed agent execution.
• Plus: background in threat hunting, incident response, detection engineering, or offensive or purple team work.
• Plus: familiarity with AI risk frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS or NIST AI RMF.
• Plus: experience in regulated or high-trust environments, or with privacy and data protection programs.
• Plus: experience building enterprise security architecture at a growing company.

Benefits

• Competitive, comprehensive benefits including medical, dental and vision coverage.
• PTO and parental leave.
• Equity.
• Company offsites.
• Continuous education.
• Commuter benefits.
• A flexible work environment.