Associate AI Security Resident

RAND•Pittsburgh, DC

1d•Hybrid

About The Position

RAND’s Center on AI, Security, and Technology (CAST), part of the Global and Emerging Risks (GER) Division, conducts cutting-edge research on transformative, high-impact technologies—including artificial intelligence and biotechnology—to shape policies that protect global security and advance the public good. Your work will address key questions related to securing AI systems, understanding their cyber capabilities, and examining their policy implications. You will be responsible for leading complex projects that span technical research, policy analysis, and infrastructure development. For example, you might lead projects to develop AI-specific threat models, build software tools for AI cyber capability evaluations, or identify critical areas for new security R&D. Your work will inform analysis delivered to senior government and industry leaders. You will communicate the results of your work to both technical and non-technical audiences through quick-turnaround policy briefs and detailed written research products. A recent example of one of our research products is the Securing AI Model Weights report, which explored protecting frontier AI models from theft and misuse. This position is structured as a three-year appointment with options to renew and explore opportunities for longer-term employment at RAND thereafter. RAND's reputation for excellence is built on our commitment to high-quality, rigorous analysis and objectivity. As an Associate AI Security Resident, you'll maintain that excellence while engaging with some of the most pressing challenges of our time.

Requirements

Excellent analytic skills.
Ability to communicate clearly and effectively, both orally and in writing.
Ability to work effectively as a member of a multi-disciplinary team.
Strong commitment to RAND's core values of quality and objectivity.
Technical experience in security engineering, software engineering, firmware engineering, hardware engineering, or related fields.
Technical management experience, including leading cross-functional teams, managing project budgets, and mentoring and developing team members.
Demonstrated ability to successfully lead complex projects to completion.
Proficiency in Python, Java, C/C++, or other popular programming languages.
Ability to develop rigorous and comprehensive threat models and identify potential system vulnerabilities.
Excellent communication skills, both written and verbal, tailored to technical and non-technical audiences.
Ability to reason about policy options given different technical considerations.
Ability to work effectively in a collaborative, multidisciplinary environment.
Fluency with MS Office suite.
Ability to obtain and maintain a U.S. government clearance is preferred but not required.

Nice To Haves

Graduate of the Computer Network Operations Development Program (CNODP), Remote Interactive Operator Training (RIOT), Future Operator Readiness Growth and Enrichment (FORGE), or equivalent experience.
Experience with red team operations or offensive cyber capabilities development.
Understanding of advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) and experience with defending against them.
Ability to think creatively about offensive and/or defensive techniques and strategies, beyond compliance with existing regulations.
Familiarity with U.S. cybersecurity agencies, authorities, and policy development processes.
Experience working in or with government on cybersecurity policy.
Experience with advising non-technical stakeholders on security topics.
Familiarity with the AI/ML hardware stack (e.g., GPUs, TPUs, data center design).
Familiarity with the AI/ML software stack (e.g., CUDA, PyTorch, TensorFlow, Ray).
Experience working on AI research, ML model training, or model deployment.
Experience with securing AI systems.

Responsibilities

Leading complex projects that span technical research, policy analysis, and infrastructure development.
Developing AI-specific threat models.
Building software tools for AI cyber capability evaluations.
Identifying critical areas for new security R&D.
Communicating the results of your work to both technical and non-technical audiences through quick-turnaround policy briefs and detailed written research products.