AI Security Officer

Sourcebooks•Naperville, IL

4d•$105,000 - $125,000

About The Position

Sourcebooks is seeking an AI Security Officer to help teams adopt AI tools and build AI-enabled solutions securely. The role partners with the Information Security Officer, IT, the AI team, Legal, and business owners to assess risk, establish practical safeguards, and support AI initiatives from pilot through production. Reporting to the Sr. Manager, Security & Operations, this is a hands-on individual contributor position combining technical security work with user enablement. The AI Security Officer will build and own the AI security review process, from intake through decisions and reassessment. The position may be hybrid or remote in New York or Naperville, Illinois, or remote from specified states. It is an exempt salaried role with an annual salary range of $110,000–$120,000. Starting pay is determined based on job-related factors including location, market conditions, experience, training, and education.

Requirements

At least 5 years of experience in cybersecurity, technology risk, GRC, or security engineering, plus practical experience assessing or securing AI tools or workflows.
Experience with risk assessments, vendor reviews, and security control testing.
Working knowledge of enterprise AI assistants, cloud and SaaS controls, identity and access management, APIs, and low-code or no-code platforms.
Familiarity with ISO 27001 or NIST frameworks, including the NIST AI Risk Management Framework.
Ability to explain risk in plain language and coordinate technical and business reviews.
Relevant bachelor’s degree or equivalent experience.

Nice To Haves

Experience with Citizen Developer governance or AI security testing.
Familiarity with ISO/IEC 42001.
Certifications such as CISSP, CISM, CISA, or CRISC.

Responsibilities

Build and improve the AI security review process, including intake forms, risk criteria, assessment templates, configuration standards, and review records, aligning it with existing governance and compliance processes.
Manage the AI review queue from intake through documented disposition; prioritize requests, coordinate reviews, communicate approval conditions, and maintain an inventory of approved uses, owners, restrictions, and reassessment dates.
Assess AI tools and manage reviews of embedded and new features, plugins, connectors, APIs, and agents, including vendor evidence, data flows, prompt retention, model training use, deletion, permissions, and relevant security exposures.
Document inherent and residual risks, controls, remediation owners, and due dates; recommend approval, conditional approval, or rejection; and track findings until controls are verified or residual risks are accepted by authorized decision makers.
Perform hands-on security validation with IT and solution owners by reviewing configurations and permissions, testing misuse scenarios and access boundaries, and verifying data protections, human approval, logging, and rollback before release recommendations.
Reassess approved capabilities when vendors, models, features, integrations, data access, or intended uses change; check configuration drift and control effectiveness, follow corrective actions to closure, and confirm secure access removal and data handling at retirement.
Own security controls for the Citizen Developer program, reviewing proposed data access and automated actions, explaining security requirements and mitigating controls, and helping teams resolve findings before pilots and production use.
Work with the AI team to understand proposed use cases, business needs, and planned implementations.
Serve as the security liaison between the AI team and IT, translating AI requirements into practical controls, coordinating risk assessments and technical reviews, and helping resolve security issues during adoption and deployment.
Develop and deliver practical AI security training and guidance for users, Citizen Developers, and administrators, covering sensitive data, output verification, prompt injection, AI-enabled fraud, and incident reporting; use recurring findings to update training.
Maintain and exercise AI incident playbooks; provide investigation and containment expertise during IT-led response, help business owners test fallback procedures, and incorporate lessons learned into controls and guidance.
Report review volumes, turnaround, assessment coverage, overdue findings, and AI risk trends to the ISO and leadership; maintain audit evidence, escalate unresolved risks, and recommend improvements based on review outcomes and control testing.