AI Security Engineer, Defensive Automation

Norm•Washington D.C., WA

1d•Hybrid

About The Position

Norm is hiring Senior AI Security Engineers to build automated, AI-driven systems that identify, prioritize, and remediate security weaknesses. The role spans the security lifecycle, from discovery and threat modeling through remediation and incident response, with a focus on either offensive research or defensive operations depending on the candidate’s strengths. The engineer reports to the Chief Security Officer and works closely with Engineering. The role involves designing and improving defensive security automation with appropriate testing, safeguards, and human oversight; assessing system risks through threat modeling; participating in the response rotation for critical vulnerabilities and security events; measuring security effectiveness; and communicating risks and tradeoffs to technical and non-technical audiences. Research-focused work includes hunting for unknown weaknesses, validating and reproducing findings, and improving automation based on what is learned. Operations-focused work includes vulnerability management at scale and using threat intelligence and external advisories to prioritize remediation. Norm prefers team members to be fluent in AI and expects candidates to demonstrate practical, hands-on use of AI tools and workflows. The position is hybrid, with Washington, DC preferred and New York City also listed. Travel to the New York City headquarters is expected at least once per quarter.

Requirements

At least 5 years of experience in application security and cloud security fundamentals.
Strong software engineering skills and production-code experience in at least one modern programming language.
Hands-on experience building with LLMs or AI agents.
Experience running threat models.
Calm, structured judgment during incidents.
Deep expertise in at least one of the following: vulnerability research, offensive security or red teaming, exploit development, CVE credits, or bug bounty work; or vulnerability management at scale, detection and response, security automation, or software supply-chain security.
Practical, hands-on AI use in day-to-day work, with concrete tools, workflows, and outcomes to discuss during the interview process.

Nice To Haves

Python experience.
Threat intelligence experience.
Experience in highly regulated industries.
Experience securing multi-tenant SaaS.

Responsibilities

Design, build, and improve AI-driven defensive security tools with production-appropriate testing, safeguards, and human oversight.
Threat-model new and existing systems and use the results to prioritize detection and remediation.
Participate in the response rotation for critical vulnerabilities and security events, from exposure assessment through remediation.
Track security performance and communicate risks and tradeoffs to technical and non-technical audiences.
For research-focused work, proactively hunt for previously unknown weaknesses using automated and manual techniques in a safe, controlled way.
Validate and reproduce findings and use lessons learned to improve security automation.
For operations-focused work, triage, prioritize, and remediate vulnerabilities at scale while automating as much of the process as possible.
Use threat intelligence and external advisories to inform remediation priorities.