Applied AI Security Engineer

Waabi•Toronto, ON

12d•$139,000 - $258,000•Hybrid

About The Position

Waabi is leaning into an AI-native strategy — not just in our trucks, but in how we build, ship, and operate every day. Our teams leverage key AI tools to enhance productivity and efficiency, continuously expanding AI integration across our systems and workflows. That's a huge unlock, and it's moving fast. We're looking for someone to make sure it keeps moving fast safely — by establishing the guardrails and collaborating on the implementation of sandboxes and automations that let people adopt AI with confidence instead of second-guessing themselves. You'll join a small, sharp security team and take primary ownership of AI security controls and considerations across the company. If you've got a developer's instincts, a security mindset, and you're genuinely curious about what these tools can and can't be trusted to do, this role is built around you.

Requirements

Bachelor's degree in Computer Science or a related field.
Professional software development experience, with solid fundamentals in how services, APIs, and permissions fit together.
Hands-on experience using AI coding/productivity tools (Claude, Copilot, Gemini, or similar) in business-critical workflows.
Working knowledge of automotive security and safety standards, such as UNECE R155 and ISO 26262.
Strong communication skills - you work with engineers as a partner.

Nice To Haves

Experience with MCP (Model Context Protocol) or similar tool-calling/agent-integration frameworks.
Exposure to prompt injection, jailbreaking, or other AI/LLM-specific attack techniques.
Background in autonomous vehicles, robotics, or other safety-critical systems

Responsibilities

Audit how AI tools and MCP integrations are currently used across the company, and map where they touch sensitive systems, data, or credentials for the purpose of defining policy.
Design and implement layered guardrails - enterprise-level system prompts, scoped permissions, sandboxing patterns - that constrain AI behavior before it ever reaches a user's request.
Maintain an inventory of both MCP servers and AI-to-service connections and their data access controls, with a clear model of what each one can access and why.
Partner directly with users across the organization to bake secure-by-default patterns into their AI-assisted workflows so that written policy doesn’t just sit on a shelf.
Evaluate new AI tools, plugins, and integration requests, and figure out the secure way to say yes.
Continuously test and red-team your own guardrails - assume they'll be pushed on, and find the gaps before someone else does.
Document guidance and patterns that a non-security audience can actually follow without needing a security background.