Security Engineer - AI

Overview

The Senior Product Security Engineer, AI Applications will serve as a senior technical member of the Product Security Team and lead highly technical security reviews across our client's commercial digital product portfolio. This role reviews the full product lifecycle and technology stack, including AI-enabled applications, web and mobile applications, APIs, cloud IaaS/PaaS architectures, SaaS platforms, IoT-connected solutions, data integrations, third-party software, and customer-facing product components.

The Senior Product Security Engineer, AI Applications will combine advanced application/product security expertise with AI-specific security skills to perform risk assessments, threat modeling, secure architecture reviews, application security testing, secure code/dependency review, and SSDLC standards development. The role will evaluate AI risks such as prompt injection, adversarial ML, data/model leakage, model theft, data integrity, bias-related risk indicators, AI supply chain exposure, and secure use of copilots, agents, plugins, and automation workflows.

• 5+ years of hands-on experience as a software developer, senior developer, application security engineer, product security engineer, or similar technical role supporting modern application architectures.
• 3+ years of experience performing application security assessments, secure architecture reviews, threat modeling, vulnerability assessments, penetration test coordination, or technical product security reviews.
• Hands-on experience with SSDLC, Dev Sec Ops , SAST, DAST, SCA, SBOM, API security, container security, secrets scanning, secure CI/CD pipeline controls, and remediation workflows.
• Hands-on experience with Microsoft Azure and AWS cloud security, including native cloud security services, IaaS/PaaS security patterns, cloud posture management, and secure workload configuration.
• Strong understanding of IAM across Azure and AWS, including OAuth 2.0, OIDC, SSO, B2C/B2B identity patterns, service principals, workload identities, Azure Managed Identity, and privileged access patterns.
• Hands-on scripting and automation experience with Python and shell scripting for security testing, data/log analysis, automation, and security tool integration.
• Experience assessing AI/ML or generative AI-enabled capabilities, including LLM integrations, prompt injection, data/model leakage, model abuse, model extraction/theft, vendor/model risk, AI threat modeling, and secure AI design patterns.
• Understanding of adversarial machine learning concepts, including evasion, poisoning, insecure model inputs/outputs, model extraction, model leakage, and abuse of AI agents, tools, or plugins.
• Working knowledge of network security fundamentals, including TCP/IP, OSI model, firewalls, IDS/IPS, network segmentation, web/application protocols, and secure service-to-service communication.
• Knowledge of identity and access management, encryption, secure API design, secrets management, secure SDLC practices, vulnerability management, logging/monitoring, privacy/security-by-design, and cloud security architecture.
• Demonstrated ability to identify, explain, prioritize, and drive remediation of complex application, cloud, AI, identity, and product security risks with engineering and product teams.

• Lead product security risk assessments across our client s commercial digital products, including AI-enabled applications, web/mobile applications, APIs, SaaS platforms, cloud services, containers, IoT solutions, endpoints, network-connected components, and third-party software.
• Develop, maintain, and mature SSDLC standards, secure design patterns, application security requirements, AI security requirements, and product security procedures aligned to practical engineering workflows.
• Perform hands-on threat modeling for applications, APIs, cloud architectures, data flows, AI/ML integrations, LLM-enabled features, copilots, agents, automation workflows, and external service integrations.
• Assess AI/ML models and AI-enabled workflows for vulnerabilities, adversarial ML risks, evasion, poisoning, model extraction/theft, prompt injection, insecure…