Senior Associate - AI Security Engineer

New York Life•New York, NY

1d•$90,000 - $128,500•Hybrid

About The Position

New York Life is seeking a hands-on AI Security Engineer to evaluate and secure emerging AI technologies through practical engineering, security testing, and proof-of-concept development. The role partners closely with the AI Security Architect to build, test, and evaluate AI security solutions across cloud and third-party platforms. It translates emerging security challenges into working prototypes, validates security capabilities and vendor claims, identifies technical risks, and develops reusable security patterns for engineering teams. A key focus is agentic AI security, including agent identity, authentication and authorization, workload identity, Model Context Protocol (MCP) security, policy enforcement, tool access, and secure agent-to-agent communication. This technical builder role calls for hands-on experience with software development, AI applications and agents, APIs, cloud platforms, identity and authorization flows, security testing, and technical documentation. The position is within New York Life's Technology, Data, AI and Ventures organization, which applies technology, data, AI, and ventures to support the company's businesses and deliver measurable outcomes. The role is hybrid, with three days per quarter at the designated location. The stated salary range is $90,000–$128,500. The position is exempt from overtime and eligible for a discretionary annual bonus; it is not sales-bonus eligible.

Requirements

At least 5 years of experience in software engineering, cybersecurity engineering, cloud security, application security, AI/ML engineering, or related technical disciplines, with demonstrated application of security principles to modern applications.
Hands-on experience with an agent framework such as Google ADK, LangChain, LangGraph, or similar technology.
At least 2 years of hands-on experience with AI/ML, Generative AI, LLM applications, or agentic AI technologies.
Strong programming and prototyping skills, preferably using Python.
Hands-on experience building or integrating LLM applications, RAG solutions, AI agents, tool-calling workflows, or MCP-based applications.
Practical experience with at least one major cloud platform: AWS, Azure, or GCP.
Strong understanding of OAuth 2.0, OIDC, JWTs, workload and service identities, API authorization, and short-lived credential models.
Experience with modern engineering technologies such as REST APIs, Git, containers, Kubernetes, CI/CD, Infrastructure-as-Code, cloud SDKs, and CLIs.
Strong understanding of application security, including API security, identity and access control, data protection, threat modeling, least privilege, secrets management, and secure SDLC.
Ability to independently research emerging technologies, build prototypes, troubleshoot complex technical issues, and clearly communicate findings and recommendations.

Nice To Haves

Hands-on experience with MCP, agent frameworks, multi-agent architectures, or agentic AI security.
Experience with AI security testing, including prompt injection, jailbreaks, data poisoning, insecure tool use, and excessive agency.
Familiarity with OWASP AI security guidance, MITRE ATLAS, or NIST AI RMF.
Experience evaluating security products or conducting technical vendor proof-of-concepts.
Experience with Terraform or other Infrastructure-as-Code technologies.
Hands-on experience with AI-assisted development tools such as GitHub Copilot, Claude Code, Cursor, or similar tools.
Experience within financial services or another regulated industry.

Responsibilities

Build, test, and evaluate AI security solutions across cloud and third-party platforms in partnership with the AI Security Architect.
Translate emerging AI security challenges into working prototypes and proof-of-concept solutions.
Validate security capabilities and vendor claims.
Identify technical risks and develop reusable security patterns for engineering teams.
Evaluate and secure emerging AI technologies through practical engineering and security testing.
Address agentic AI security topics, including agent identity, authentication and authorization, workload identity, MCP security, policy enforcement, tool access, and secure agent-to-agent communication.
Independently research emerging technologies, troubleshoot complex technical issues, and communicate findings and recommendations.
Develop and document AI security solutions and findings.