AI Security Engineer

Litera•Denver, CO

23h•Hybrid

About The Position

Litera is advancing AI across its products and internal platforms, and this role will help ensure those systems are secure, trusted, and resilient as they scale. As AI becomes more deeply embedded in our customer experiences and development workflows, the AI Security Engineer will play a critical role in protecting sensitive data, reducing emerging AI-related risks, and strengthening confidence in Litera’s AI capabilities. This role will help turn evolving AI security standards, threat intelligence, and governance expectations into practical safeguards that support innovation without compromising security.

Requirements

3–6 years of cybersecurity experience, with at least 1–2 years focused on AI/ML security, application security, or a related combination within a cloud-native SaaS or enterprise software environment.
Working knowledge of LLM security risks and mitigations, including OWASP LLM Top 10 concepts such as prompt injection, insecure output handling, RAG poisoning, model denial of service, and sensitive information disclosure.
Hands-on experience with application security fundamentals, including threat modeling, SAST/DAST, API security, secrets management, secure SDLC practices, and CI/CD pipeline security.
Technical proficiency with scripting, automation, security tooling, and AI/ML-related technologies such as LangChain, RAG pipelines, vector databases, Azure OpenAI, Amazon Bedrock, or similar platforms.
Experience securing Azure and/or AWS environments, including IAM, network segmentation, containers, Kubernetes, infrastructure-as-code scanning, and cloud-hosted AI workloads.
Strong communication and analytical skills, with the ability to explain complex AI security risks to technical and non-technical audiences and independently drive remediation.

Nice To Haves

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field; equivalent professional experience also considered.
Relevant certifications such as CAISP, CISSP, CEH, GPEN, or AWS/Azure Security specialties are a plus.
Experience with AI red teaming, adversarial ML testing tools such as Garak, PyRIT, or Counterfit, AI bug bounty programs, or AI security research.
Familiarity with AI governance frameworks and standards such as ISO 42001, NIST AI RMF, the EU AI Act, SOC 2 Type II, or ISO 27001 audit support.
Experience in B2B SaaS, legal technology, regulated professional services, enterprise customer security reviews, RFP responses, due diligence questionnaires, or security-focused sales support.

Responsibilities

Strengthen the security of Litera’s AI-enabled products, internal AI tools, and agentic AI infrastructure by identifying, assessing, and reducing risks across the AI lifecycle.
Help Product, Engineering, GRC, IT, and Security teams make informed decisions about AI adoption, vendor use, model integrations, data handling, and acceptable use.
Advance Litera’s defenses against emerging AI-specific threats, including prompt injection, jailbreaking, insecure outputs, RAG data poisoning, model abuse, data leakage, and indirect context manipulation.
Improve the security of AI-integrated product surfaces, including LLM-connected applications, MCP server integrations, agent workflows, tool-call authorization boundaries, and SaaS application interconnects.
Build and maintain scalable AI security controls, tooling, testing pipelines, detection logic, playbooks, and documentation that continuously validate AI system behavior against security expectations.
Extend identity governance and secrets management practices to cover AI agents and non-human identities, including access scoping, credential lifecycle, inventory, deprovisioning, and audit logging.
Serve as a technical security partner within Litera’s AI governance program by supporting AI impact assessments, model risk registers, secure-use policies, and control alignment with evolving AI standards.
Represent Litera’s AI security posture with internal and external stakeholders by supporting customer questionnaires, enterprise security reviews, due diligence requests, audit evidence, and sales-related security discussions.