AI Security Specialist

Experience: 510+ years in cybersecurity, with 13+ years in AI/LLM security, AppSec, cloud security, or DevSecOps (hands-on)

Reporting to: Head of AI Security Practice

Role overview

As an AI Security Specialist, you will deliver hands-on AI security work across client environments, assessing GenAI/ML systems, identifying risks, validating controls, performing AI red teaming, and helping teams implement practical fixes across cloud and application stacks.

What you will do

AI/LLM security assessments

• Assess AI applications (LLM apps, agents, RAG pipelines, ML workflows) for security and privacy risks.
• Review architecture, data flows, model usage, integrations, access controls, and deployment patterns.

AI red teaming & testing

• Execute test plans for: prompt injection (direct/indirect), RAG poisoning, data leakage, excessive tool/agent permissions, model extraction risks, unsafe output paths, abuse/misuse scenarios.
• Document findings clearly with reproduction steps and recommended mitigations.

Cloud + AppSec controls

• Help clients implement controls across identity, secrets, logging, isolation, network controls, and secure SDLC.
• Work within AWS/Azure/GCP AI stacks and typical app platforms (APIs, containers, CI/CD).

Governance & standards support

• Support lightweight governance deliverables: risk registers, policy mappings, control recommendations aligned to NIST AI RMF / OWASP LLM / ISO 23894.

Engineering accelerators

• Build reusable templates and tooling: test checklists, threat models, reference architectures, detection ideas, dashboards/metrics.

Experience and Skills:

• Strong fundamentals in: security testing, threat modelling, IAM, cloud security, secure development.
• Working understanding of common GenAI patterns: RAG, embeddings/vector DBs, agents/tools, API orchestrations.
• Familiarity with AI security risks: prompt injection, sensitive data exposure, insecure tool use, RAG poisoning, supply-chain risks.
• Ability to produce high-quality client deliverables (reports, slides, workshops).
• Good ML understanding (training vs inference, pipelines, model lifecycle).
• Exposure to MLOps/MLSecOps (model registry, pipelines, monitoring, drift concepts) would be a nice to have.