Senior Associate AI Security Engineer

*** This role is 5 days a week in Charlotte or Atlanta Office***

This team is responsible for securing Truist's adoption and use of Artificial Intelligence (AI) technologies through AI Security Posture Management (AiSPM), AI governance, risk management, and security review processes.

The team enables secure AI usage by assessing AI solutions, evaluating technology risk, identifying unauthorized AI usage, validating security controls, and supporting the safe deployment and operation of AI technologies across the enterprise.

Ideal talent will be someone with experience in cybersecurity, cloud security, security operations, risk management, or technology governance who understands enterprise technology environments and can quickly learn emerging AI technologies and associated security risks.

Experience with AWS and Azure environments, security monitoring platforms, cloud security tools, and AI technologies is preferred. Prior AiSPM experience is not required.

Assist in the design, planning, implementation, testing, and operationalization of AI security governance, posture management, risk assessment, and security review capabilities.

The role will support AI security reviews, Shadow AI investigations, control validation efforts, AI risk assessments, and AI security monitoring initiatives.

For AI Security, one part of the role involves evaluating AI use cases, technologies, and architectures against security and governance requirements. Another part focuses on identifying, assessing, and reducing risks associated with approved and unapproved AI technologies.

The successful candidate will help establish and mature processes, operate effectively in ambiguous situations, and partner across engineering, architecture, risk, compliance, legal, and business teams to enable secure AI adoption.

• Conduct AI security reviews and risk assessments for enterprise AI use cases, technologies, and solutions.
• Support AI governance processes and validate AI security controls against established requirements and standards.
• Investigate and analyze Shadow AI activity using security monitoring, cloud security, and endpoint protection platforms.
• Assess AI implementations for security, privacy, regulatory, operational, and data protection risks.
• Develop and maintain AI security review methodologies, governance processes, and risk assessment procedures.
• Implement and support AI posture management, monitoring, and reporting capabilities.
• Identify, document, track, and coordinate remediation activities for AI-related risks and findings.
• Analyze AI-related telemetry, detections, and security events to identify trends, risks, and emerging threats.
• Collaborate with cross-functional teams including Security Engineering, Enterprise Architecture, Risk Management, Compliance, Legal, Technology, and Business Units.
• Support the development and operationalization of AI security capabilities and risk reduction initiatives.

• Crowd Strike
• Wiz
• Microsoft Defender
• Microsoft Purview
• Zscaler
• Azure AI Services
• Azure OpenAI
• AWS AI Services
• Governance and Risk Management Platforms
• AI Security Assessment Frameworks
• Security Monitoring and Detection Platforms
• Generative AI Technologies and Large Language Models (LLMs)

• Strong understanding of cybersecurity principles, risk management practices, and security controls.
• Experience performing security assessments, technology reviews, investigations, threat analysis, or risk evaluations.
• Knowledge of cloud technologies and security principles across AWS and/or Azure environments.
• Familiarity with AI, machine learning, generative AI, or emerging technology security concepts.
• Understanding of common AI security risks, including data leakage, prompt injection, excessive permissions, model misuse, and third‑party AI supply chain risks.
• Experience with security monitoring, posture management, detection, vulnerability management, or cloud security platforms.
• Familiarity with security technologies such as Crowd Strike, Wiz, Microsoft Defender, Purview, Zscaler, or similar platforms.
• Ability to analyze security telemetry, detections, and technology usage patterns.
• Strong…