Lead AI Security Engineer

FM•Johnston, RI

12d•Hybrid

About The Position

The Lead AI Security Engineer is a senior technical role responsible for enabling the secure adoption of AI capabilities across the organization. This role defines and evolves security and risk requirements for enterprise AI capabilities, in addition to designing and implementing the supporting controls. The role operates at the intersection of cybersecurity, platform engineering, and emerging AI technologies, supporting enterprise AI solutions such as Microsoft Copilot, Claude, and internally developed or platform-based agentic AI systems, including Azure AI Foundry. The role translates emerging AI risks, security expectations, and enterprise requirements into clear, actionable, and scalable security patterns that can be consistently applied across platforms. The incumbent serves as a hands-on technical leader and subject matter expert, partnering with platform, engineering, and product teams to design, evaluate, and implement security capabilities for AI systems, while establishing standards and guidance for ongoing operations. In areas where security owns and administers the relevant controls, this role leads tool selection, control design, and implementation, with other teams potentially supporting day-to-day operations. In areas where security is not the system owner, this role consults with platform teams to ensure systems are configured and administered appropriately and effective security guidance is defined and applied. This is a hands-on leadership role for someone who can define the security model for enterprise AI, not just implementing requirements provided by others. The successful candidate should be able to identify AI-related security risks, develop clear requirements and guardrails, and help teams implement those controls in a practical and scalable way. The role requires strong security engineering judgment, practical AI understanding, and the ability to balance risk reduction with business enablement.

Requirements

7+ years of experience in information technology or cybersecurity, including at least five years in security engineering or a related technical area such as cloud security, identity and access management, data protection, application security, security operations, vulnerability management, incident response, or platform security.
Hands-on experience designing and implementing security controls in modern environments, including cloud platforms, APIs, identity systems, data protection, and monitoring.
Experience defining security requirements, standards, guardrails, or control frameworks in complex enterprise environments.
Practical experience or strong working knowledge of AI or LLM-based systems, including their behavior, risks, and security implications.
Experience partnering with engineering and platform teams to integrate security into architecture, design, delivery pipelines, and operations.
Demonstrated ability to evaluate technologies and guide technical decision-making.
Experience operating in complex, cross-functional environments and driving initiatives from concept through implementation.
Strong technical knowledge of cybersecurity principles, including identity and access management, data protection, monitoring, secure architecture design, and security operations.
Strong understanding of AI and LLM-related risks, including data exposure, prompt manipulation, unsafe tool use, misuse of agent capabilities, and auditability challenges.
Ability to develop security and risk requirements from ambiguous or emerging technology risks.
Ability to translate security requirements into practical engineering solutions, configurations, and implementation patterns.
Familiarity with industry frameworks and guidance such as NIST Risk Management Framework, MITRE ATLAS, OWASP Top 10, and OWASP guidance for large language model applications.
Strong analytical, problem-solving, and communication skills.
Ability to work independently and collaboratively across teams.
Bachelor’s degree in information security, Computer Science, Information Technology, or related field (Equivalent experience may be considered)

Nice To Haves

Familiarity with Azure-based platforms and services, including Azure AI Foundry or related capabilities, preferred.
Exposure to enterprise AI platforms such as Microsoft Copilot, Claude, or similar platforms, preferred.
Relevant certifications, such as CISSP, CISM, Security+, GIAC, or cloud security certifications, preferred.

Responsibilities

Lead the definition, design, and implementation of security capabilities that enable secure enterprise AI adoption across platforms such as Microsoft Copilot, Claude, and agentic AI frameworks.
Define security and risk requirements for enterprise AI platforms and agent-based systems.
Translate security, risk, and regulatory expectations, including emerging AI risks, into clear technical controls, guardrails, and implementation patterns aligned to relevant industry frameworks and enterprise requirements.
Partner with AI platform, engineering, and product teams to embed security requirements and controls into architecture, design, delivery, and operations.
Conduct security reviews and threat modeling for AI use cases, agent workflows, integrations, and platform capabilities to identify required controls before production deployment.
Define and guide implementation of controls related to AI agent identity, tool and API access, data usage constraints, auditability, and agent behavior in enterprise environments.
Lead evaluation, proof-of-concept, and selection of activities for native and third-party capabilities that support AI security, governance, and control objectives.
Assess integration requirements across enterprise identity, logging, monitoring, data protection, and security tooling.
Drive cross-functional implementation efforts involving security, platform, engineering, and product teams to operationalize AI security capabilities and supporting processes.
Maintain practical standards, guidance, and best practices for secure AI deployment, configuration, and ongoing platform administration.
Provide consultation and technical direction where security is not the system owner, ensuring effective security requirements are defined and applied.