AI Security Manager

Location: Any location in the United States

Work Arrangement: Remote

A Day in the Life

The AI Security Manager is responsible for leading the firm's AI security practice, setting security standards for AI-enabled systems, autonomous agents, and multi-platform AI workloads across the Microsoft environment. This role serves as the day-to-day security authority for AI adoption: conducting enterprise architecture reviews of how AI products align to the firm's Microsoft platform, partnering with the data team on data governance for AI workloads, and supporting the legal and risk teams to ensure the firm's AI-related contractual and policy language is accurate and defensible.

The AI Security Manager may manage a team of security engineers or serve as a hands-on technical thought leader for the practice; in either case, this person owns an area of the practice and is responsible for its health. The role balances leadership and execution to deliver secure, governed, responsible AI adoption aligned with Zero Trust principles, the firm's “TRUST” framework, NIST AI RMF, and OST priorities.

A typical day as a AI Security Manager might include the following:

• Leads the firm's AI security practice, translating AI security strategy into standards, controls, and delivery outcomes across initiatives.
• Serves as a technical authority on the Microsoft 365 E7 security stack as the firm's primary AI security control plane, including Entra , Defender, Purview, Sentinel, Agent 365, and Intune, and extends these controls to govern third-party AI platforms (Anthropic, OpenAI, Google) through federation, compliance API integration, and conditional access enforcement.
• Conducts enterprise architecture reviews of AI products, agents, IDE extensions, and M365 add-ins, assessing how each aligns to the firm's Microsoft environment, identity model, data boundaries, and reference architecture before approval.
• Applies the EA Decision Scoring Matrix and security risk assessment criteria to approve or deny AI tool and platform requests, and supports Application Portfolio Management intake for AI and agentic applications.
• Partners with the data team on data governance for AI workloads, including data classification, sensitivity labeling, retention, Purview DLP policy, semantic and grounding data boundaries, and access control for AI-consumed data sources.
• Supports the legal and risk teams by reviewing and informing AI-related legal, contractual, and policy language, including vendor terms, data retention and training commitments, client-facing AI disclosures, and acceptable use policy, ensuring statements about the firm's AI controls are technically accurate.
• Defines and enforces security policies for autonomous agents, ensuring every digital worker operates within governed, auditable boundaries.
• Performs AI threat modeling and risk assessment across identity, endpoint, network, data, application, and AI-specific vectors, including prompt injection, data poisoning, model exfiltration, and agent drift.
• Monitors and governs MCP server connections, OAuth consent flows, and cross-platform agent communications, ensuring external integrations are allow-listed and observable through Defender for Cloud Apps and Agent 365.
• Integrates third-party AI compliance APIs into the firm's centralized SIEM, supporting unified detection, alerting, and incident correlation across all AI platforms.
• Supports design and governance of isolated development environments for installed AI coding tools, including identity isolation, network segmentation, conditional access, endpoint registration, and user-level activity monitoring.
• Partners with the EB Security Team, enterprise architecture, and digital delivery teams to embed AI security into every layer of the…