AI Security Engineer
Key Responsibilities
• AI Security Architecture & Design Review: Review the design of AI applications, RAG pipelines, AI agents and MCP integrations before development. Perform threat modeling for AI-specific risks such as prompt injection, data poisoning, model inversion, excessive agency and tool misuse.
• AI Guardrails & Platform Controls: Design, deploy and tune AI guardrails and protective controls (e.g. Google Model Armor, Amazon Bedrock Guardrails).
• Secure AI-Assisted Development: Define and maintain security controls for AI coding tools and agents (e.g. Cursor, Kiro, Antigravity), including rules, MCP server and skill vetting, and secure coding guardrails integrated with the CI/CD and AppSec pipeline.
• AI Risk Assessment & Governance: Conduct pre-deployment AI risk assessments, define mitigating controls, and develop AI security standards, guidelines and checklists aligned with NIST AI RMF, ISO/IEC 42001, OWASP LLM / Agentic Top 10.
• Threat Intelligence & Enablement: Monitor emerging AI threats and vulnerabilities, advise project teams and management, support AI-related incident response with the SOC, and deliver AI security awareness to developers and IT staff.
Qualifications
• Bachelor's degree in Computer Engineering, Computer Science, Cybersecurity or a related field.
• At least 3–5 years of experience in cybersecurity.
• At least 1 year of hands-on experience in AI security, such as securing LLM applications, AI red teaming, or implementing AI guardrails.
• Solid understanding of LLM and agentic AI architecture: prompting, RAG, embeddings/vector databases, function calling, AI agents and MCP.
• Strong knowledge of AI threat frameworks: OWASP Top 10 for LLM Applications, OWASP Agentic AI Top 10, MITRE ATLAS.
• Hands-on experience with at least one cloud AI platform (Google Vertex AI / Gemini, Amazon Bedrock or Azure OpenAI) and its security controls.
• Experience with threat modeling and application security; familiarity with OWASP Top 10 (Web, API), OWASP ASVS and secure SDLC.
• Understanding of security and risk frameworks such as NIST AI RMF, ISO/IEC 42001, and regulatory requirements for financial institutions (BOT, SEC, OIC).
• Ability to explain AI risks clearly to both technical teams and management.
Nice to Have
• Experience with AI red team tools and frameworks (Promptfoo, Garak, PyRIT)
• Experience securing AI coding assistants and agentic IDEs in an enterprise setting.