Senior AI Security Engineer

Mercola is seeking a Senior AI Security Engineer to own day-to-day enterprise security, lead technical incident response, and help secure the company’s use of AI. The role also strengthens security controls, builds automation, and partners with Infrastructure and Engineering to manage and verify security improvements.

Responsibilities:

• Own the incident queue, risk register, and remediation backlog. Assign owners and deadlines, maintain policies and runbooks, and report progress and unresolved risks to leadership
• Lead technical incident response from triage through recovery validation. Coordinate containment, preserve evidence, and involve Legal or specialist responders as needed
• Strengthen identity, access, and infrastructure controls across Microsoft 365, Entra ID, AWS, and connected applications. Partner with Infrastructure to verify improvements across endpoints, servers, networks, and cloud platforms
• Validate logging coverage, retention, alert delivery, and after-hours escalation with internal owners and managed security providers
• Use AI assistants for investigation, code review, threat analysis, and automation. Independently validate findings and proposed fixes before acting on them. Secure AI applications, agents, and Model Context Protocol (MCP) integrations against prompt injection, excessive permissions, data exposure, and unsafe tool actions
• Partner with Engineering on application, API, and mobile security. Integrate code, dependency, and secret scanning into development workflows, prioritize exploitable findings, coordinate authorized testing, and verify remediation
• Build security automation with Python, PowerShell, APIs, or comparable tools. Document ownership, failure alerts, audit trails, and rollback procedures
• Assess vendor security, data flows, and third-party access. Maintain security evidence for applicable contractual, privacy, and compliance needs, and coordinate security awareness and specialist support

Requirements:

• Hands-on experience in security engineering, incident response, or security operations, with examples of taking issues through investigation, remediation, and verification
• Practical experience securing hybrid environments across Microsoft 365 and Entra ID, cloud services such as AWS, endpoints, and networks
• Ability to interpret logs and assess access, application permissions, and potential data exposure
• Experience using AI assistants in engineering or security work
• Ability to explain how you limit permissions, protect sensitive information, and validate AI-generated output
• Ability to write scripts, work with APIs, and review application code or configurations for security issues
• Familiarity with Git and CI/CD workflows
• Ability to prioritize competing security work, coordinate technical owners and providers, and communicate risks and decisions clearly to leadership
• Sound judgment about evidence preservation, testing authorization, production changes, and when to involve specialists
• Experience with Microsoft Defender or comparable endpoint protection, security information and event management (SIEM), or managed detection services
• Experience with Azure DevOps, application or API security testing, cloud or container security, or governance of AI coding tools and MCP integrations
• Relevant certifications or a degree are welcome
• Mercola values demonstrated capability and equivalent experience equally