AI Security Operations Lead

Job Title: AI Sec Ops & Detection Lead
- Discovery, Response & Prevention

Location: Remote (U.S.) | Blue Bell, PA area team

Employment Type: Contract (W2 through Zip Staff
- No C2C or 1099)

Zip Staff is seeking an AI Sec Ops & Detection Lead to build and operate the AI security lifecycle for a leading healthcare analytics and payment-integrity organization.

This role answers three questions: do we have full visibility into AI in use, can we respond when something goes wrong, and are we feeding lessons back into prevention. You will integrate AI findings from tools such as Wiz and AIM into existing SOC workflows - not a separate queue. Shadow-AI discovery, AI IR playbooks, and auditable governance are core. This is a senior hands-on Sec Ops lead, not a policy-only GRC seat.

• Integrate AI-specific alerts and findings from Wiz, AIM, and similar tools into existing SOC / SIEM / SOAR pipelines.
• Build and operate shadow AI discovery using telemetry - not self-reporting.
• Create AI-specific incident response playbooks and lead tabletop exercises.
• Translate discovery findings and incident patterns into remediation requests and tighter controls.
• Maintain the AI tool inventory, risk assessments, and audit-ready documentation.
• Quantify detection efficacy, coverage gaps, and risk-posture trends for leadership.
• Partner with SOC, engineering, compliance, and security leadership.

• 10+ years of hands-on enterprise Sec Ops / detection engineering / incident response.
• Deep experience with SIEM/SOAR
  , detection logic, alert triage, and IR in complex enterprise environments.
• Proven ability to operationalize asset discovery and telemetry mapping across cloud and on-prem.
• Working knowledge of AI-specific threats:
  prompt injection, model poisoning, agent credential abuse, data exfiltration - and how to turn them into detections.
• Experience embedding specialized findings (Wiz, AIM, or equivalent) into a unified SOC workflow.
• Metrics-driven risk management (detection efficacy, coverage gaps, executive reporting).
• Experience maintaining visibility across hybrid (cloud + on-prem) environments.
• Ability to work remote in U.S. time zones aligned to the Blue Bell, PA team.
• Must be legally authorized to work in the United States without sponsorship now or in the future.

• Healthcare, payment integrity, or other regulated-industry Sec Ops.
• Prior ownership of an AI / shadow-IT discovery program.
• Tabletop exercise design for emerging-technology incidents.
• Familiarity with cloud security platforms beyond Wiz (CSPM / CNAPP).