Senior AI Security Engineer
Ernst and Young14 days ago
Taguig City, PhilippinesSenior
Responsibilities
- Review and threat-model LLM, RAG, agentic AI, and multi-agent architectures.
- Identify security risks across models, prompts, data sources, vector databases, memory, tools, APIs, and MCP integrations.
- Design and validate AI security controls and guardrails for inputs, outputs, data access, tool execution, and autonomous actions.
- Conduct AI security assessments and red-team testing for prompt injection, jailbreaks, sensitive-data disclosure, poisoning, excessive agency, unsafe tool use, and privilege abuse.
- Assess MCP clients, servers, tools, resources, authorization, permissions, and third-party integrations.
- Build automated security tests and evaluation harnesses for GenAI and agentic AI applications.
- Validate access controls, least-privilege implementation, human-approval mechanisms, secure secret handling, logging, and monitoring.
- Integrate AI security testing into development and release processes.
- Document findings, recommend remediation, and translate AI risk and governance requirements into technical controls.
- Collaborate with engineering and security teams to embed security throughout the AI development lifecycle and monitor emerging AI threats.
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Technology, or a related discipline, or equivalent practical experience.
- Five or more years of relevant experience in cybersecurity, application security, software engineering, cloud security, AI engineering, or related fields.
- Strong understanding of GenAI application architecture and its security risks, including LLMs, prompt design, RAG, embeddings, vector databases, data-ingestion pipelines, and guardrails.
- Hands-on experience building, integrating, testing, or securing AI agents and tool-enabled workflows.
- Knowledge of agent planning, memory, tool execution, multi-agent workflows, human-in-the-loop controls, and MCP architecture, authorization, permissions, and security.
- Experience with application security assessments, threat modeling, security testing or red teaming, and current OWASP guidance for GenAI, LLM, and agentic applications.
- Knowledge of secure application architecture, API security, identity and access management, secrets management, and data protection.
- Strong hands-on Python scripting or development skills, plus experience with APIs, SDKs, authentication, Git, and automated testing.
- Ability to review, debug, test, and secure human-written and AI-generated code independently.
- Experience with Azure AI Foundry, Azure OpenAI, or comparable enterprise AI platforms.
- Working knowledge of ISO/IEC 42001, the NIST AI Risk Management Framework and Generative AI Profile, and the EU AI Act.
- Strong analytical, problem-solving, documentation, communication, and stakeholder-management skills.
- Preferred experience developing AI security testing or evaluation frameworks and using Promptfoo, DeepEval, Ragas, LangSmith, MLflow, or similar tools.
- Preferred experience with regulated-industry AI security controls, ISO/IEC 42001 support, AI impact assessments, or EU AI Act compliance.
- Preferred familiarity with Azure security, Azure DevOps, Docker, Kubernetes, or AKS, and knowledge of model training, fine-tuning, adversarial machine learning, or AI supply-chain security.
- Relevant cybersecurity, cloud security, AI security, or AI governance training or certification is preferred.
About Ernst and Young
Ernst & Young (EY) provides audit/assurance, tax, consulting, strategy and transactions services to enterprises, financial institutions, and public‑sector clients. Structured as a global network of partner‑owned member firms, it sells professional services on a fee basis, including a dedicated Financial Services Organization for banking, insurance, and capital markets. Headquartered in London, EY was formed in 1989 from the merger of Ernst & Whinney and Arthur Young, and operates in 150+ countries.