Generate a McCoy IQ challenge in 30 seconds.
See how candidates think and approach the work this role demands, before the phone screen. We'll build a video challenge from this posting, and you can edit or share it before it goes live.
Key details
Why this role is notable
The day-to-day work is red-teaming and threat-modeling autonomous AI agents, RAG pipelines, and MCP tool integrations for prompt injection, excessive agency, and unsafe tool use. That discipline, adversarially testing agents that act on their own, barely existed as a job category a few years ago.
Job Description
Position Summary
We are seeking a Senior AI Security Engineer to assess and strengthen the security of enterprise Generative AI and agentic AI solutions.
The ideal candidate has an end-to-end understanding of GenAI application architecture, including Large Language Models (LLMs), Retrieval-Augmented Generation (RAG), embeddings, vector databases, guardrails, AI agents, tools, memory, and Model Context Protocol (MCP).
This role will conduct AI threat modeling, security assessments, red-team testing, and automated security evaluations. The candidate should be technically hands-on and capable of building or modifying AI agents, RAG applications, APIs, MCP integrations, and security-testing automation.
The role will work closely with AI engineering, application security, cloud, privacy, risk, and governance teams to ensure that AI solutions are secure, resilient, and aligned with organizational requirements.
Key Responsibilities
- Review and threat-model LLM, RAG, agentic AI, and multi-agent architectures.
- Identify security risks across models, prompts, data sources, vector databases, memory, tools, APIs, and MCP integrations.
- Design and validate security controls and guardrails for AI inputs, outputs, data access, tool execution, and autonomous actions.
- Conduct AI security assessments and red-team testing for threats such as prompt injection, jailbreaks, sensitive-data disclosure, poisoning, excessive agency, unsafe tool use, and privilege abuse.
- Assess the security of MCP clients, servers, tools, resources, authorization, permissions, and third-party integrations.
- Build automated security tests and evaluation harnesses for GenAI and agentic AI applications.
- Validate access controls, least-privilege implementation, human-approval mechanisms, secure secret handling, logging, and monitoring.
- Integrate AI security testing into development and release processes.
- Document security findings and provide clear, practical remediation recommendations.
- Translate AI risk and governance requirements into appropriate technical controls.
- Collaborate with engineering and security teams to embed security throughout the AI development lifecycle.
- Stay current with emerging GenAI threats, agentic AI attack techniques, MCP security risks, and defensive practices.
Required Skills and Experience
- Strong understanding of the end-to-end GenAI application lifecycle and its security risks.
- Practical knowledge of LLMs, prompt design, RAG, embeddings, vector databases, data-ingestion pipelines, and guardrails.
- Hands-on experience building, integrating, testing, or securing AI agents and tool-enabled workflows.
- Understanding of agent planning, memory, tool execution, multi-agent workflows, and human-in-the-loop controls.
- Knowledge of MCP architecture, authorization, permissions, and security considerations.
- Experience conducting application security assessments, threat modeling, and security testing or red teaming.
- Familiarity with current OWASP guidance for GenAI, LLM, and agentic applications.
- Knowledge of secure application architecture, API security, identity and access management, secrets management, and data protection.
- Strong hands-on Python scripting or development skills.
- Experience working with APIs, SDKs, authentication, Git, and automated testing.
- Ability to independently review, debug, test, and secure human-written and AI-generated code.
- Experience with Azure AI Foundry, Azure OpenAI, or comparable enterprise AI platforms.
- Working knowledge of relevant AI risk and governance frameworks, including ISO/IEC 42001, the NIST AI Risk Management Framework and its Generative AI Profile, and the EU AI Act, with the ability to translate applicable requirements into technical controls.
- Strong written and verbal communication skills, including the ability to explain technical risks to business stakeholders.
Qualifications
- Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Technology, or a related discipline, or equivalent practical experience.
- Five or more years of relevant experience in cybersecurity, application security, software engineering, cloud security, AI engineering, or related fields.
- Demonstrated hands-on experience working with Generative AI or agentic AI solutions.
- Strong analytical, problem-solving, documentation, and stakeholder-management skills.
Preferred Qualifications
- Experience developing AI security testing or evaluation frameworks.
- Experience with Promptfoo, DeepEval, Ragas, LangSmith, MLflow, or similar tools.
- Experience implementing or assessing AI security controls in regulated industries.
- Experience supporting ISO/IEC 42001, AI impact assessments, or EU AI Act compliance activities.
- Familiarity with Azure security, Azure DevOps, Docker, Kubernetes, or AKS.
- Knowledge of model training, fine-tuning, adversarial machine learning, or AI supply-chain security.
- Relevant professional training or certification in cybersecurity, cloud security, AI security, or AI governance.
