DevSecOps Engineer

Razor is seeking a Security Engineer with expertise in Information Assurance and DevSecOps to support the development and security of a multi-tenant AI/MLOps platform. The role involves ensuring compliance with federal cybersecurity standards while addressing security risks related to AI/ML workloads and collaborating with various engineering teams.

Responsibilities:

• Perform security assessments and execute Risk Management Framework (RMF) processes for a highly multi-tenant AI/MLOps platform, ensuring the system achieves and maintains Authorization to Operate (ATO)
• Identify risks associated with AI/ML models, data pipelines, and training workflows; recommend secure configurations and policies
• Partner with DevOps and MLOps engineers to embed DevSecOps practices throughout the AI/ML lifecycle, including secure CI/CD pipelines for model training, deployment, and monitoring
• Define and validate security measures for AI/ML model governance, including protections against poisoning, ensuring data privacy, and managing tenant isolation
• Secure multi-tenant cloud environments by implementing workload segmentation, least privilege, and effective identity and access management (IAM) for tenants
• Use tools such as Prisma Cloud and Twistlock to secure containerized workloads, and collaborate with development teams to remediate vulnerabilities in AI models, libraries, and frameworks
• Monitor and test platform security using vulnerability scanners, network monitors, and compliance methods aligned with NIST 800-53 and federal requirements
• Utilize SNOW CAM to document security artifacts, maintain compliance evidence, and report progress to stakeholders
• Collaborate with data scientists, MLOps engineers, and platform teams to ensure security while balancing usability and performance

Requirements:

• Bachelor's degree in engineering or a related scientific or technical discipline is required
• 12+ years total IT DevSecOps experience
• 3+ years of cybersecurity experience performing A&A processes and applying NIST RMF requirements to cloud-native environments
• 3+ years experience securing or working with multi-tenant systems, preferably AI/ML platforms or data-intensive applications
• Experience with containerized environments (Kubernetes, Docker) and AI/ML frameworks (TensorFlow, PyTorch, MLflow)
• Familiarity with AI/ML security challenges including data provenance, adversarial attacks, and secure model deployment
• Knowledge of tenant isolation techniques including network segmentation, user/group roles, and identity federation
• Hands-on experience implementing DevSecOps pipelines using IaC tools (Terraform, Ansible) and scripting languages (Python, Bash)
• Working knowledge of AWS GovCloud, Azure Government, or other compliance-focused cloud regions
• Expertise using vulnerability scanning and remediation tools such as Nessus, OWASP ZAP, or cloud-based security platforms
• Experience with compliance standards including NIST SP 800-53, 800-37, ISO/IEC 27001, or comparable frameworks
• Familiarity with AI ethics, data privacy laws, and their intersection with security in federal contracts
• Experience configuring secure model training and inference workflows, addressing data leakage, model drift, and adversarial ML threats
• Knowledge of trusted AI principles, model poisoning mitigations, and techniques to prevent data reconstruction attacks
• Hands-on knowledge of encryption methods for AI/ML data at rest and in transit, including data lake security and homomorphic encryption
• Familiarity with federated learning and securing decentralized AI models
• Exposure to Elasticsearch or high-performance database security