AI Security Engineer, Defensive Automation

Norm Ai•Washington, DC

6d•$155,000 - $215,000•Hybrid

About The Position

Norm Ai is hiring AI Security Engineers to build automated, AI-driven systems that find, prioritize, and remediate security weaknesses. The role spans discovery, threat modeling, remediation, and incident response, with a focus on either offensive research or defensive operations based on the candidate’s strengths. The position reports to the Chief Security Officer and works closely with Engineering. The engineer will design and improve AI-driven defensive security tooling with production-quality testing, safeguards, and human oversight; assess systems for risk; participate in responses to critical vulnerabilities and security events; and measure and communicate security performance, risks, and tradeoffs. Depending on focus, the role may include vulnerability research and validation, or large-scale vulnerability management and applying threat intelligence to remediation priorities. Norm Ai expects team members to be fluent in AI and to use it practically in their day-to-day work. Candidates should be prepared to discuss and demonstrate concrete AI tools, workflows, and outcomes during interviews.

Requirements

Strong software engineering skills, including production code in at least one modern language.
Hands-on experience building with LLMs or AI agents.
Solid application security and cloud security fundamentals.
Experience running threat models.
Calm, structured judgment during incidents.
Deep expertise in at least one area: vulnerability research, offensive security or red teaming, exploit development, CVE credits, bug bounty work, vulnerability management at scale, detection and response, security automation, or software supply-chain security.
Practical, hands-on use of AI in day-to-day work and ability to discuss concrete tools, workflows, and outcomes.

Nice To Haves

Threat intelligence experience.
Experience in highly regulated industries.
Experience securing multi-tenant SaaS.

Responsibilities

Design, build, and improve AI-driven security tooling with appropriate testing, safeguards, and human oversight.
Threat-model new and existing systems and use risk assessments to guide detection and remediation efforts.
Participate in the response rotation for critical vulnerabilities and security events, from exposure assessment through remediation.
Track security performance and communicate risks and tradeoffs to technical and non-technical audiences.
Proactively hunt for previously unknown weaknesses using automated and manual techniques in a safe, controlled manner.
Confirm and reproduce research findings and use lessons learned to improve automation.
Triage, prioritize, and remediate vulnerabilities at scale, automating the process where possible.
Use threat intelligence and external advisories to inform remediation priorities.