AI Application Security Architect

ACV Auctions; Toronto; On-site; CAD 180,000 - 240,000; Full time

Benefits offered by this job

Healthcare

Stock purchase program

Parental leave top-up

RRSP retirement

Learning & development

Job summary

ACV Auctions in Toronto, ON is seeking a Principal Architect, Product Security to define target-state secure architectures for AI/ML systems and guide high-risk AI and application designs. You will own the security architecture for AI-assisted engineering, mentor engineers, stand up AI security testing, and translate policy into actionable technical controls across ACV's cloud-native stack.

This role demands 12+ years in security, hands-on GenAI security, and a proven track record of building

Qualifications

• 12+ years of security experience, 15+ years without degree
• Hands-on GenAI/LLM security work with production impact
• Proven security architecture ownership for AI-enabled systems

Responsibilities

• Define ACV's target-state secure architecture for AI/ML systems and reference patterns
• Protect integrity of AI-driven pipelines and work with fraud/inspection teams on controls
• Set secure-by-default standards for AI development: prompt handling, permissions, data handling
• Threat model and review high-risk AI/app designs using MITRE ATLAS, OWASP Top 10 for LLM/Agentic apps
• Own security architecture for AI-assisted engineering and guardrails for velocity
• Stand up AI security testing capability: adversarial tests, red-teaming, evaluation harnesses

Skills

Security architecture

GenAI/LLM security

Cloud security

Leadership & influence

Python coding

English communication

Education

Bachelor's degree in a related field

Tools

Garak

PyRIT

promptfoo

Job description

Posted Thursday, August 13, 2026 at 4:00 AM

If you are looking for a career at a dynamic company with a people-first mindset and a deep culture of growth and autonomy, ACV is the right place for you! Competitive compensation packages and learning and development opportunities, ACV has what you need to advance to the next level in your career. We will continue to raise the bar every day by investing in our people and technology to help our customers succeed. We hire people who share our passion, bring innovative ideas to the table, and enjoy a collaborative atmosphere.

Who we are: ACV is a technology company that has revolutionized how dealers buy and sell cars online. We are transforming the automotive industry. ACV Auctions Inc. (ACV), has applied innovation and user-designed, data driven applications and solutions. We are building the most trusted and efficient digital marketplace with data solutions for sourcing, selling and managing used vehicles with transparency and comprehensive insights that were once unimaginable. We are disruptors of the industry and we want you to join us on our journey. Our network of brands include ACV Auctions, ACV Transportation, ClearCar, MAX Digital and ACV Capital within its Marketplace Products, as well as, True360 and Data Services.

At ACV we focus on the Health, Physical, Financial, Social and Emotional Wellness of our Teammates and to support this we offer:

• Company Sponsored (paid) Healthcare, Dental, Vision, Life/AD&D, Short-Term and Long-Term Disability.
• Comprehensive additional optional benefits such Critical Illness and Supplemental Life/AD&D.
• All insurance benefits go into effect on your date of hire.
• Generous Parental Leave Top-Up Pay and Vacation Programs.
• Employee Stock Purchase Program with additional opportunities to earn stock in the company.
• Retirement planning through the Company’s RRSP.

Who we are looking for:

ACV Auctions is hiring an Principal Architect, Product Security to secure how we build and ship AI, as part of the Product Security team. ACV's marketplace runs on AI that customers stake real money on: computer vision models that grade vehicle condition, pricing models that inform lending decisions, and LLM features across our products. You will define how that surface gets protected, and how our engineers use AI coding assistants and agents without trading away security. You will help engineering deliver secure applications across ACV's marketplace, protecting sensitive dealer, consumer, vehicle, and payment data.

Company-wide security architect for AI systems and the applications built around them. Defines ACV's target-state secure architecture, reference architectures, and standards for machine learning and LLM-powered systems, and guides the highest-risk AI and application designs across engineering. A P6 architecture-track role alongside Principal Engineer on the Product Security Career Ladder. Company / multi-year scope; owns AI and application security architecture and standards; sets direction on the most consequential design decisions.

Focus areas: this role spans AI/ML security and application security. It is a technical architecture role. ACV's AI Governance function owns policy, risk registers, and regulatory alignment; this role owns the technical controls and architecture that make those policies real in production systems.

What you will do:

• Actively and consistently support all efforts to simplify and enhance the customer experience.
• Define ACV's target-state secure architecture and reference patterns for AI/ML systems: LLM features, retrieval pipelines, agentic workflows, and the computer vision models behind vehicle condition and pricing.
• Protect the integrity of ACV's vision-based condition and pricing pipeline against adversarial inputs and manipulated or AI-generated imagery, partnering with fraud and inspection teams on detection and image-provenance controls.
• Set secure-by-default standards adopted across engineering for AI development: prompt injection defense, output handling, tool and agent permissioning, and model and training-data supply chain security.
• Threat model and review the highest-risk AI and application designs, applying frameworks such as MITRE ATLAS and the OWASP Top 10 lists for LLM and Agentic Applications.
• Own the security architecture for AI-assisted engineering: coding assistants, MCP servers, and autonomous agents, with guardrails that preserve developer velocity across an API-first engineering organization.
• Stand up ACV's AI security testing capability: adversarial testing and red-teaming of models and LLM features, evaluation harnesses, and runtime guardrails, making deliberate build-vs-buy decisions.
• Advise engineering and security leadership on multi-year AI security strategy, and partner with AI governance to translate policy into enforceable technical controls.
• Scale AI security expertise across engineering, including through ACV's Security Champions program; mentor Staff and Principal engineers; and represent ACV's AI security architecture externally.
• Perform additional duties as assigned.

What you will need:

• Ability to read, write, speak and understand English.
• Bachelor's degree in a related field, or commensurate experience.
• 12+ years' of security experience, 15+ years' without degree, including deep application security architecture.
• Hands-on GenAI/LLM security work required, demonstrated through production experience or a verifiable body of work: AI red-team engagements, published research or tooling, open-source contributions, or AI security competition results.
• 2+ years of production AI security experience preferred.
• Security architecture: owns the enterprise secure-architecture vision for AI systems and application security.
• AI/ML security depth: LLM application threats (prompt injection, insecure output handling, data leakage through retrieval, excessive agency in agents and tools) and model-level threats (poisoning, evasion, extraction, malicious pre-trained models).
• Hands-on technical fluency: reads and writes code (Python preferred) and has personally used AI security tooling (e.g., Garak, PyRIT, promptfoo, or equivalent) rather than only evaluating vendors.
• Frameworks: working fluency with the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, MITRE ATLAS, and NIST AI RMF, and the ability to turn them into standards engineers actually follow.
• Standards and patterns: defines reference architectures and paved-road standards, including for AI-assisted development.
• Influence: aligns engineering and ML leadership to the target architecture.
• Application security (commensurate with level): OWASP Top 10, secure code review, threat modeling, and SAST/DAST/SCA tooling (e.g., Snyk, Checkmarx, GitHub Advanced Security, Burp Suite).
• Cloud security (commensurate with level): cloud-native security on AWS, Kubernetes, and infrastructure-as-code; familiarity with ML platforms and inference infrastructure (e.g., SageMaker, Bedrock) a plus.
• Comfort working in a fast-paced, cloud-native environment with clear written and verbal communication.
• Illustrative credentials (a plus, not required): SABSA or equivalent architecture credentials, CCSP or a cloud security specialty. A demonstrated body of AI security work (research, tooling, red-team findings, AI CTF results, open-source contributions) carries more weight than any certification; the AI security credential market is not yet mature.

#LI-AM3

Our Values

Trust & Transparency | People First | Positive Experiences | Calm Persistence | Never Settling

At ACV, we are committed to an inclusive culture in which every individual is welcomed and empowered to celebrate their true selves. We achieve this by fostering a work environment of acceptance and understanding that is free from discrimination. ACV is committed to being an equal opportunity employer regardless of sex, race, creed, color, religion, marital status, national origin, age, pregnancy, sexual orientation, gender, gender identity, gender expression, genetic information, disability, military status, status as a veteran, or any other protected characteristic. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires reasonable accommodation, please let us know.

For information on our collection and use of your personal information, please see our Privacy Notice.

No immigration or work visa sponsorship provided for this position.

Compensation: The compensation range for this position is listed in the "Job Details" section at the bottom of this posting. Please note that final compensation will be determined based upon the applicant's relevant experience, skillset, location, business needs, market demands, and other factors as permitted by law.