Key skills
AI/ML securityThreat modelingAdversarial testingLarge language model (LLM) securityPrompt injectionJailbreakingModel inversionData poisoningMembership inferenceAdversarial example attacksSecure AI development lifecycle (AI-SDLC)Data governanceAccess controlsModel deployment guardrailsThird-party AI vendor risk assessmentAPI-based AI service evaluationOpenAIAnthropicClaude CodeAzure OpenAIAI governance frameworksNIST AI RMFOWASP Top 10 for LLM ApplicationsMITRE ATLASEU AI ActISO/IEC 27001 2022 ISMSPyTorchTensorFlowAWS BedrockGoogle Vertex AIApplication securityInfrastructure securityWeb application testingNetwork securitySecure codingPythonJavaScriptCISSPCSSLPGWEBGMLSCIdentity and access managementOktaSAMLOAuthSOC 2Adversarial ML attacksRAG pipeline abuseAgentic AI systemsIntegrity & ResponsibilityCross-Functional InfluenceAIArtificial IntelligenceMachine LearningMLLLMClaudeRAGAgenticAWSAzureBedrockVertex AISDLCLeadershipOWASPNetwork Security
About this role
ISC2 is the world’s leading nonprofit member organization for cybersecurity professionals, dedicated to creating a safe and secure cyber world. The AI Security Engineer is responsible for identifying and mitigating security risks associated with artificial intelligence and machine learning systems, collaborating with various teams to embed security controls throughout the AI development lifecycle.
Responsibilities:
- Perform security assessments of AI/ML systems, including threat modeling, adversarial testing, and of LLM-based applications and AI-powered products and services integrated into ISC2’s products and operations
- Evaluate AI/ML implementations for vulnerabilities including prompt injection, jailbreaking, model inversion, data poisoning, membership inference, and adversarial example attacks
- Define and implement secure AI development lifecycle (AI-SDLC) standards, including secure model training, data governance, agent, and other access controls, and model deployment guardrails
- Conduct third-party AI vendor and model supply chain risk assessments; evaluate API-based AI services (e.g., OpenAI, Anthropic,Claude Code, Azure OpenAI) for data handling, privacy, and security posture
- Partner with engineering and product teams to review AI feature designs, conduct pre-deployment security reviews, and provide risk acceptance recommendations for AI-related SSDLC exceptions
- Monitor the evolving AI threat landscape;maintain awareness of emerging attack techniques, regulatory developments (EU AI Act, NIST AI RMF), and industry best practices (OWASP Top 10 for LLMs, MITRE ATLAS)
- Support ISC2’s ISO/IEC 27001:2022 ISMS by mapping AI risk controls to applicable Annex A requirements (including A.8.25 through A.8.29) and contributing AI-specific risk treatment plans to the organizational risk register
- Develop and deliver internal training and awareness content on responsible AI use, AI-specific threats, and secure integration patterns for developers and business stakeholders
- Contribute to ISC2’s thought leadership in AI security by supporting content, certification, and research initiatives aligned with the organization’s mission
- Perform miscellaneous duties as assigned
Requirements:
- Bachelor's degree in computer science, Data Science, Cybersecurity, or a related field. Will consider candidates with a high school diploma and at least seven (7) years of cybersecurity experience
- 3+ years of experience in cybersecurity, with at least 1–2 years focused on AI/ML security, application security, or a closely adjacent field
- Experience assessing data privacy risks in AI pipelines, including training data handling, PII exposure, and model output monitoring
- Hands-on experience with AI/ML security testing techniques, including adversarial ML attacks, LLM prompt injection, RAG pipeline abuse, and tool-use exploitation in agentic AI systems
- Intellectual Curiosity: Thrives in an ambiguous, rapidly evolving domain; proactively explores emerging AI capabilities and their security implications
- Integrity & Responsibility: Approaches AI security with a strong ethical foundation, particularly around bias, fairness, privacy, and dual-use risks of AI systems
- Cross-Functional Influence: Able to translate complex AI risk concepts for diverse audiences including engineers, executives, auditors, and non-technical business stakeholders
- Adaptability: Comfortable operating without established playbooks; exercises sound judgment when standards, regulations, and tooling are still maturing
- Mission Alignment: Demonstrates genuine commitment to ISC2's mission of supporting a safe and secure cyber world; brings professionalism and advocacy to the AI security discipline
- Familiarity with AI/ML frameworks (PyTorch, TensorFlow) and cloud-based AI services (Azure OpenAI, AWS Bedrock, Google Vertex AI)
- Working knowledge of AI governance frameworks: NIST AI RMF, OWASP Top 10 for LLM Applications, MITRE ATLAS, and the EU AI Act risk categories
- Foundation in traditional application and infrastructure security, including web application testing, network security, and secure coding principles (Python, JavaScript)
- Relevant certifications preferred: CISSP, CSSLP, GWEB, GMLSC, or emerging AI security certifications; ISC2 certifications are valued
- Demonstrated research, publication, conference presentations, or open-source contributions in the AI security space are a strong differentiator
- Experience with identity and access management in cloud environments, including Okta and SAML/OAuth, is preferred given ISC2's technology stack
- Experience supporting ISO/IEC 27001, SOC 2, or similar compliance programs is a plus