AI Security Engineer

HCL Technologies Limited; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

HCLTech, a global technology leader with a London-based AI security mandate, seeks an Senior AI Security Engineer to secure AI/ML systems within a regulated banking platform.

Role focuses on threat modeling, detection engineering, and secure development practices using Python and Go. Hybrid London location, collaboration across security, engineering, and product teams.

Qualifications

• Advanced Python and Go proficiency for ML tooling and security tooling.
• Familiarity with AI security frameworks and threat modeling concepts.
• Experience with DevOps tools and CI/CD pipelines in secure environments.

Responsibilities

• Lead threat modeling for enterprise AI deployments and critical workflows.
• Design automated security architectures to enforce secure-by-design AI integrations.
• Develop detection logic to identify adversarial queries, prompt injections and data exfiltration patterns.

Skills

Python

Go

AI literacy

Tools

Docker

Kubernetes

Terraform

Splunk

Elastic Security

Datadog

Job description

HCLTech is a global technology company, home to 219,000+ people across 54 countries, delivering industry-leading capabilities centered on digital, engineering and cloud, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of $13+ billion.

For more information on how we process your personal data, please refer to HCLTech’ s Candidate Data Privacy Notice.

Job Title: AI Security Engineer

Role Overview

As an AI Security Engineer, you will focus on securing cutting-edge Artificial Intelligence (AI) and Machine Learning (ML) systems within our enterprise banking platform. In this role, you will address security risks uniquely associated with AI infrastructure, Large Language Models (LLMs), and autonomous decisioning pipelines.

You will lead threat modeling, design automated detection systems, execute offensive security assessments, and build specialized response mechanisms to defend the bank from adversarial machine learning attacks (e.g., prompt injection, data poisoning, model extraction).

• Location: London, UK (Hybrid)
• Sector: Highly Regulated Financial Services / Banking
• Experience Level: Senior / Specialist

Primary Roles & Responsibilities

• Perform deep-dive Threat Modeling assessments on enterprise AI deployments and workflows to expose systemic architectural flaws before production deployment.
• Leverage AI Literacy to evaluate foundational model risks, focusing specifically on vulnerabilities mapped out by the OWASP Top 10 for LLMs and the MITRE ATLAS framework.
• Design, build, and scale automated security architectures (Security Engineering) that establish secure-by-design boundaries for multi-tenant AI integrations.

2. Offensive Security Testing & Detection Engineering

• Conduct automated and manual adversarial simulations (Offensive Security Testing) against deployment endpoints, evaluating model resilience against adversarial evasion, inversion, and data poisoning.
• Architect and implement specialized rules (Detection Engineering) to detect malicious queries, prompt injections, and data exfiltration patterns within streaming log structures.
• Execute active Cyber Threat Hunting cycles across core infrastructure to trace subtle anomalies indicating compromised training data pipeline elements or model drift manipulation.

3. Secure Development & Infrastructure Automation

• Write production-grade, highly optimized software tooling using Go (Golang) and Python to build security guardrails, custom wrappers, and proxy monitors for LLM applications.
• Embed security scanning, model validation, and drift analysis into modern infrastructure systems using DevOps methodologies and automated pipeline practices.
• Operate natively inside an ecosystem governed by Agile Methodology & Tools (e.g., Jira, Confluence) to cleanly track security initiatives alongside fast-moving development sprint tracks.
• Design and deploy real-time monitoring and defensive guardrails (Advanced Threat Protection) to isolate and mitigate malicious traffic targeting production AI endpoints.
• Develop incident playbooks (Response Engineering) specifically tailored to handle active exploitation of machine learning environments.
• Lead structural investigation procedures (Digital Forensics) following an anomaly or attack vector event, performing root‑cause analysis on logs, system runtime snapshots, and compromised data artifacts.

Secondary Roles & Responsibilities

1. Customer Centricity & Stakeholder Collaboration

• Champion a mindset of Customer Centricity, ensuring that heavy security layers and model guardrails do not negatively disrupt the user experience or performance parameters for banking consumers.
• Act as an expert consultant for application teams, translating dense AI vulnerabilities into plain, actionable mitigation plans.

2. Continuous Learning & Research Contribution

• Dedicate time to Continuous Learning by tracking the volatile, fast‑evolving AI threat landscape, incorporating new vulnerability research straight into the team’s defense playbooks.
• Evaluate emerging third‑party security platforms, proxy tools, and open‑source packages to modernize the bank’s security capabilities.

Technical Stack & Skills Required

• Languages: Advanced proficiency in Python (for ML tooling and scripting) and Go Programming Language (for building low‑latency security proxies and microservices).
• AI Security Frameworks: Comprehensive understanding of MITRE ATLAS, OWASP LLM Top 10, and standard evaluation tools (e.g., Garak, Inspect).
• DevOps Ecosystem: Container security frameworks (Docker, Kubernetes), CI/CD engineering pipelines, and Infrastructure-as-Code platforms (Terraform).
• Security & SIEM Tools: Experience developing custom detection logic inside tools like Splunk, Elastic Security, or Datadog.

Regulatory Context

All deployments must be engineered to securely satisfy rigorous UK and EU regulatory frameworks governing automated banking solutions, specifically:

• DORA (Digital Operational Resilience Act) parameters for continuous ICT risk testing.
• FCA Guidance on Artificial Intelligence regarding transparent governance, model validation, and consumer safety rules.