Staff Security Engineer, AI

Compa•Irvine, CA

4d•$202,500 - $275,000

About The Position

Compa is hiring a Staff Security Engineer to help build secure, governed AI systems for an AI-first company. Reporting directly to the Head of Security and IT, this senior member of the Security team will build the identity, access, data, endpoint, SaaS, and network foundations that enable employees and AI agents to work securely. The role focuses on creating reusable infrastructure, policies, standards, and reference architectures that make secure adoption of AI tools straightforward and scalable, while also strengthening Compa’s broader security program. The successful candidate is a hands-on security engineer who prioritizes security and privacy, reasons from threats and trust boundaries, and enables teams by creating practical secure paths to their goals. The role partners with IT, engineering, legal, privacy, and business leaders to translate ambiguous requests into requirements and deliver solutions in production. It also involves governing agent and service-account access, controlling data flows to and from models, evaluating AI vendors, assessing attack paths and residual risk, and building logging, detection, and automated enforcement.

Requirements

Significant hands-on security engineering experience and strong security fundamentals, with a security- and privacy-first approach.
Experience designing, building, or securing AI systems or integrations, such as agents and tool use, retrieval over internal data, or MCP.
Working understanding of AI-system attacks, including prompt injection, data leakage, and excessive agency.
Deep experience with identity and access architecture, including SSO and federation (SAML, OIDC), conditional access and MFA, privileged access, identity lifecycle, non-human identities, and OAuth consent and scopes.
Hands-on experience securing endpoints and SaaS, including device management across major operating systems, device posture in access decisions, SaaS admin controls, third-party integrations, and audit logging.
Strong cloud and network security fundamentals, such as cloud IAM, segmentation, and egress control.
Working understanding of adversary TTPs and attack paths across identity, endpoint, cloud, and SaaS.
Builder’s habits, including making secure configurations the default, using code to automate repeatable work, and versioning configurations and agent skills in a repository.
Staff-level judgment: ability to reason from requirements to architecture, turn novel problems into concrete plans, and explain trade-offs and residual risk to technical and non-technical audiences.

Nice To Haves

Hands-on experience deploying AI security controls such as MCP gateways, LLM proxies, or sandboxed agent execution.
Background in threat hunting, incident response, detection engineering, or offensive or purple-team work.
Familiarity with AI risk frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, or NIST AI RMF.
Experience in regulated or high-trust environments, or with privacy and data protection programs.
Experience building enterprise security architecture at a growing company.

Responsibilities

Design and implement reusable security architecture for AI tools and agents across identity, data, endpoints, SaaS, and networks.
Codify secure AI practices in policies, standards, and reference architectures so new tools can be adopted through established processes.
Help teams adopt approved AI tools quickly and make secure adoption the easiest path.
Own requests end to end: define requirements, design and implement solutions, and support them in production in partnership with IT, engineering, legal, privacy, and business leaders.
Define authentication and authorization for agents, service accounts, and integrations, including scoped credentials, OAuth scope governance, least privilege, and human-in-the-loop checkpoints for consequential actions.
Govern how internal data reaches models and agents and how it leaves, using classification, permission-aware retrieval, AI gateways with DLP, MCP and tool allowlisting, and egress controls.
Assess third-party models and AI vendors for security, data retention, and training-use terms.
Assess attack paths for models, agents, and integrations, including prompt injection, unsafe tool use, OAuth abuse, and data exfiltration; determine and document mitigations and residual risk.
Build audit logging for prompts, tool calls, and agent actions, and detections for anomalous tool use and unexpected data movement.
Automate enforcement so secure configurations scale and remain the default.
Contribute to security initiatives across identity, endpoint, SaaS, cloud, network, detection, and incident response.