Staff AI Security Engineer

Role overview

A senior staff engineering position focused on AI and LLM security within a platform security team that protects a multi-cloud (Azure and AWS) SaaS serving regulated industries. The role spans both defensive controls for AI features and offensive use of AI to surface and remediate security defects faster than traditional programs allow. It is responsible for shaping how the organization adopts LLMs safely at production scale and contributing the AI-security lens to adjacent security programs.

Responsibilities

- Design and ship data-handling controls—filters, redaction pipelines, and infrastructure guardrails—for internal AI tooling and product AI features, ensuring sensitive data is removed before prompts, model context, logs, or outputs reach a third-party model provider. - Build and productionize an AI-augmented vulnerability reduction capability integrated with CI/CD, with low false-positive rates and remediation that preserves developer trust. - Develop and evolve a self-serve secure-LLM-use pattern for engineering teams, including input filtering, output validation, data classification by provider tier, and lightweight threat-model shortcuts. - Threat-model internal AI tools for prompt injection, indirect prompt attack surfaces, model exfiltration, and agent-tool boundary weaknesses, partnering with red teams to build fixes with tool owners. - Partner with compliance to shape auditor-facing evidence for AI-assisted controls, including which evidence formats hold up when the collector was an LLM and where human review must gate disclosure. - Advise on emerging LLM security tooling and AI-forward internal workflows, deciding what to adopt, skip, or build in-house.

Requirements

- 10+ years across security and engineering, with recent focus on production AI/ML systems including LLM deployments, model risk, or AI-driven security tooling. - Hands-on experience shipping controls that operate on LLM inputs and outputs: redaction, filtering, output validation, and prompt-injection defense. - Experience building detection systems for PII and secrets across large, messy datasets, with judgment on when regex, trained classifiers, or LLMs are appropriate. - Track record of taking AI/security work from concept to production, including false-positive management and developer experience design. - Cloud security fundamentals across Azure and AWS: RBAC, secret management, key handling, and network egress controls. - Strong programming in Python and Go, with comfort reading TypeScript and PowerShell for integration points.

Nice to have

- Experience with multi-provider LLM APIs and orchestration layers, plus PII/secrets detection at the prompt boundary (for example, Microsoft Presidio or custom pipelines). - Familiarity with SAST, SCA, and secrets tooling, and cloud security posture management platforms for signal fusion into AI-driven remediation. - CI/CD integration work using GitHub Actions and Azure DevOps, and comfort with SIEM and log analytics tooling for audit trails.

Benefits and work setup

Compensation range: $289,320—$537,360 USD total target compensation, inclusive of base pay and a performance-based bonus, with offers typically made below the midpoint. Comprehensive benefits include medical, dental, and vision coverage starting on day one, mental health support through an employee assistance program, a 401(k) with company match, and tax-advantaged spending accounts. Time-off policy includes self-care days, paid volunteer hours, paid parental leave (8 weeks for all parents, 16 weeks for birthing parents), and unlimited PTO. Additional offerings include fertility and family-planning support, 24/7 virtual pet care, legal and identity protection, and supplemental insurance options. Learning is supported through on-demand libraries, mentoring, workshops, and an annual learning day. The organization operates as an equal opportunity employer.