AI Security & DevOps Engineer

Casper Studios

2d•$150,000 - $180,000•Remote

About The Position

Casper Studios is seeking an AI Security & DevOps Engineer to oversee the secure transition of AI systems from prototype to production. This role involves establishing and enforcing technical standards, including threat modeling, secure defaults, authentication and secrets management, CI/CD gates, and AI-specific controls. The engineer will also manage client security interactions, translating their requirements into actionable builds and providing evidence for enterprise deployment approval. The position is cross-engagement, focusing on Microsoft stacks within regulated enterprises, covering identity, cloud, data protection, and agent-specific security. The successful candidate will differentiate between proof-of-concept and production systems in sensitive environments and determine what gets deployed.

Requirements

Deep hands-on application and product security experience - you've threat modeled, found real vulnerabilities, and written the fixes yourself
Real DevOps and platform depth: CI/CD, infrastructure-as-code, cloud (Azure especially, plus AWS/GCP), secrets management, and observability. You've built the pipeline, not just reviewed it
Identity and authentication depth - OAuth/OIDC, SSO/SCIM, RBAC, conditional access - with working knowledge of Microsoft Entra
Demonstrated LLM and agent security expertise: prompt injection, excessive agency, tool and connector permissioning, insecure output handling, retrieval abuse, and AI supply chain risk
Secure SDLC in practice: SAST/DAST/SCA, dependency and supply chain controls, and automated review engineers don't route around
The judgment to right-size controls to the stage and the stakes
Client-facing credibility - you can hold a room with an enterprise security team and translate risk into terms an executive can decide on
AI-native mindset - you use modern AI tooling daily with customized workflows. You can't threat model an agent system you've never built with
High agency and strong writing. The standards, evidence packs, and memos are yours, and they need to be good enough that busy people act on them

Nice To Haves

Regulated-industry exposure - financial services, healthcare, or another environment where security review is genuinely adversarial
Consulting, agency, or forward-deployed background where you earned trust with a client's security org rather than inherited it
Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, or ISO 42001
SOC 2 or ISO 27001 experience - useful context, not the job
AI red teaming, adversarial testing, or abuse-case analysis

Responsibilities

Own Casper's dev-to-production security standard and make it something engineers actually use
Define and run the security gate in our delivery process: threat models, design reviews, and the call on what ships
Harden what we build - identity and authentication, secrets management, data protection, egress controls, and the agent surface: prompt injection, tool and connector permissioning, untrusted input in agent loops, MCP auth
Own the platform work security depends on: CI/CD, automated scanning and review across our repos, infrastructure-as-code, environment and access management, logging and telemetry
Audit our own repos and internal systems, and fix what you find
Lead the client security conversation - engage their security team early, extract requirements, map approved and unapproved vendors, and produce the threat models and evidence packs that clear review the first time
Set our point of view on preferred vendors for auth, secrets, telemetry, and scanning so engagements stop relitigating the same decisions
Feed security into scoping - realistic timelines and a production roadmap that accounts for how long validation takes
Raise the security bar across engineering through review, pairing, and written standards