Staff Security Engineer, Enterprise AI

Role overview

Build and operate a repeatable security review process for enterprise AI and large language model systems. The role assesses architecture, data flows, permissions, and AI-specific threats, then develops practical controls that help teams adopt internal tools and AI features safely. It also serves as a senior security partner across engineering, IT, legal, privacy, and compliance.

Responsibilities - Review internal AI tools, agent-based systems, and AI features early in design, and continuously improve the review process. - Threat model AI applications and data flows for prompt injection, unsafe outputs, excessive autonomy, tool misuse, data poisoning, and exposure of sensitive information; drive fixes. - Examine code, prompts, agent settings, and tool permission definitions, and help teams create security tests and red-team scenarios before launch. - Build guardrails for access boundaries, authentication and authorization, data handling, monitoring, and policy automation. - Assess AI features in third-party software as part of vendor security reviews and inform adoption decisions based on risk. - Track emerging AI security issues, contribute to incident response playbooks, and guide technical and executive stakeholders.

Requirements - Hands-on experience designing and assessing security architecture for AI or LLM systems, alongside deep knowledge of enterprise security controls. - Practical skill threat modeling AI applications and securing agents, tool-calling frameworks, and trust boundaries between agents and tools. - Experience creating AI governance materials, such as acceptable-use and data-handling standards or model and vendor risk assessments. - Familiarity with enterprise AI visibility and control tools, identity systems, and common workplace software environments. - Ability to develop security tooling with Python or a similar language and deploy cloud controls or policy-as-code using infrastructure as code; cloud and container experience is useful. - Understanding of retrieval-augmented generation, embeddings, fine-tuning, tool use, and authentication models for machine-to-machine access; strong communication and cross-functional leadership.

Nice to have

Experience in regulated environments, such as those subject to SOC 2 or PCI DSS, and applying identity controls to agents or other non-human accounts.

Benefits and work setup

The position is described as remote-first within the country of employment, with occasional office work possible and in-person onboarding. Listed benefits include health coverage for employees and dependents, monthly technology and wellness stipends, flexible time off, holidays, and an employee stock purchase plan.