Senior Product Security Engineer, AI Applications

What You'll Do: Support and perform product security risk assessments across the organization's digital products and client-facing technology solutions, including AI-enabled applications, web/mobile applications, APIs, SaaS platforms, cloud services, containers, IoT solutions, endpoints, network-connected components, and third-party software. Develop, maintain, and support SSDLC standards, secure design patterns, application security requirements, AI security requirements, and product security procedures aligned to practical engineering workflows. Perform hands-on threat modeling for applications, APIs, cloud architectures, data flows, AI/ML integrations, LLM-enabled features, copilots, agents, automation workflows, and external service integrations. Assess AI/ML models and AI-enabled workflows for vulnerabilities, adversarial ML risks, evasion, poisoning, model extraction/theft, prompt injection, insecure output handling, data/model leakage, data integrity weaknesses, bias-related risk indicators, and control effectiveness. Evaluate AI governance, ethical use, privacy, data lineage, training/evaluation dataset controls, production monitoring, vendor/model risk, and secure AI data pipeline practices in partnership with product, privacy, risk, and compliance teams. Conduct technical security reviews using SAST, SCA, SBOM, DAST, secrets scanning, API security, container security, cloud security posture, vulnerability management, and AI security evaluation tools. Use and help operationalize platforms such as Snyk, Wiz, GitHub Advanced Security, DAST tooling, threat modeling tools, SBOM/SCA tooling, CI/CD security tooling, native Azure/AWS security services, SIEM/log analysis tools such as Elastic, and AI security evaluation tools. Partner with software engineering and DevSecOps teams to integrate security controls, test gates, evidence collection, automated response workflows, and remediation tracking into CI/CD pipelines and product release processes. Review identity, access, and secure communication architectures, including IAM, OAuth 2.0, OIDC, SSO, B2C/B2B identity patterns, service principals, workload identities, Azure Managed Identity, privileged access, encryption, secure APIs, secrets management, logging/monitoring, and service-to-service communication. Analyze application, cloud, API, container, endpoint, and AI security telemetry to support threat detection, anomalous behavior investigation, incident triage, containment support, product risk decisions, and prioritized remediation plans. Translate technical findings into concise remediation guidance, risk inputs, standards updates, metrics, and stakeholder-ready summaries for product, engineering, security, customer-facing, risk, and compliance stakeholders. Support customer-facing cybersecurity discussions, questionnaires, audits, and technical documentation related to the organization's product security program, AI security controls, product architecture, and SSDLC practices. Stay current on application security, AI security, adversarial ML, cloud security, DevSecOps, vulnerability management, secure coding, threat intelligence, and relevant frameworks and standards including NIST, OWASP, CIS, ISO 27001, SOC 2, and ISO/IEC 5338.