AI Security Officer

Sourcebooks•Naperville, IL

2d•Hybrid

About The Position

Sourcebooks is seeking an AI Security Officer to help teams adopt AI tools and build AI-enabled solutions securely. This hands-on individual contributor will partner with the Information Security Officer, IT, the AI team, Legal, and business owners to assess risk, establish practical guardrails, and support AI initiatives from pilot through production. Reporting to the Sr. Manager, Security & Operations, the role owns the AI security review process from intake through decision and reassessment. The position can be hybrid or remote in New York or Naperville, Illinois, or remote from Arizona, Connecticut, Illinois, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, Montana, New Jersey, New York, Ohio, Oregon, Pennsylvania, Tennessee, Texas, Virginia, Washington, Washington D.C., or Wisconsin. It is an exempt salaried role with an annual salary range of $110,000–$120,000. Starting pay is determined based on job-related factors, including geographic location, market conditions, relevant experience, training, and education.

Requirements

At least 5 years of experience in cybersecurity, technology risk, GRC, or security engineering.
Practical experience assessing or securing AI tools or workflows.
Experience with risk assessments, vendor reviews, and security control testing.
Working knowledge of enterprise AI assistants, cloud and SaaS controls, identity and access management, APIs, and low-code or no-code platforms.
Familiarity with ISO 27001 or NIST frameworks, including the NIST AI Risk Management Framework.
Ability to explain risk in plain language and coordinate technical and business reviews.
A relevant bachelor’s degree or equivalent experience.

Nice To Haves

Experience with Citizen Developer governance or AI security testing.
Familiarity with ISO/IEC 42001.
Certifications such as CISSP, CISM, CISA, or CRISC.

Responsibilities

Build and improve the AI security review process, including intake forms, risk criteria, assessment templates, configuration standards, and review records, aligning it with existing governance and compliance processes.
Manage the AI review queue from intake through documented disposition; prioritize requests, coordinate reviews, communicate approval conditions, and maintain an inventory of owners, approved uses, restrictions, and reassessment dates.
Assess AI tools and manage reviews of embedded and new features, plugins, connectors, APIs, and agents, including vendor evidence, data handling, permissions, and security risks.
Document inherent and residual risks, mitigating controls, remediation owners, and due dates; recommend approval, conditional approval, or rejection and track findings through verification or authorized risk acceptance.
Perform hands-on security validation with IT and solution owners, reviewing configurations and permissions, testing misuse scenarios and access boundaries, and verifying data protections, human approval, logging, and rollback before release.
Reassess approved capabilities when vendors, models, features, integrations, data access, or intended uses change; check configuration drift and control effectiveness, follow corrective actions to closure, and confirm secure access removal and data handling at retirement.
Own security controls for the Citizen Developer program; review proposed data access and automated actions, explain requirements and mitigations, and help teams resolve findings before pilots and production use.
Work with the AI team to understand proposed use cases, business needs, and implementations; serve as a security liaison with IT, translate AI requirements into practical controls, coordinate reviews, and help resolve security issues during adoption and deployment.
Develop and deliver practical AI security training and guidance for users, Citizen Developers, and administrators, covering sensitive data, output verification, prompt injection, AI-enabled fraud, and incident reporting.
Maintain and exercise AI incident playbooks; provide investigation and containment expertise during IT-led response, help business owners test fallback procedures, and incorporate lessons learned into controls and guidance.
Report review volumes, turnaround, assessment coverage, overdue findings, and AI risk trends to the ISO and leadership; maintain audit evidence, escalate unresolved risks, and recommend improvements based on review outcomes and control testing.