Sr. AI Security Engineer

Backblaze; Mexico; On-site; PHP 3,683,241 - 5,524,861; Full time

Job summary

Backblaze is looking for a Senior AI Security Engineer to design safeguards for internal AI usage, focusing on agentic systems and runtime security. The right fit will have over 7 years of security engineering experience, strong programming skills in Python, and familiarity with AI-assisted tools.

You will be responsible for architecting guardrails for AI systems, preventing unauthorized actions, and implementing identity access controls. Joining Backblaze means contributing to innovative practices in a welcoming workplace.

Qualifications

• 7+ years in security engineering or backend systems.
• Strong programming skills, preferably in Python.
• Experience in AI-assisted development and associated security.
• Knowledge of security enforcement layers.

Responsibilities

• Design and implement safeguards for internal AI usage.
• Architect guardrails for AI systems and implement enforcement mechanisms.
• Build detection capabilities and log AI activity.
• Perform threat modeling for agentic systems.

Skills

Security engineering experience

Backend systems expertise

Strong programming skills (Python preferred)

Experience with AI-assisted development tools

Logging and monitoring systems knowledge

Education

7+ years in security engineering

Tools

OpenTelemetry

ELK

Job description

Backblaze is seeking a Senior AI Security Engineer to design and implement safeguards for internal AI usage, with a focus on agentic systems, developer protection, and runtime security.

What You’ll Do

Agentic AI Safeguards

• Architect and implement guardrails for tool-using AI systems, including:
  • Tool access controls and allowlists
  • Context and memory isolation
  • Step-level validation of agent actions
• Apply mitigations aligned to the OWASP Agentic AI Top 10 (e.g., prompt injection, unsafe tool use, data leakage, excessive autonomy).

Runtime Security Controls

• Build enforcement mechanisms that govern AI behavior at execution time:
  • Interceptors, proxies, or middleware for tool/API calls
  • Policy decision and enforcement layers
  • Rate limits, execution bounds, and kill-switches
• Prevent unsafe or unauthorized actions initiated by AI systems.

Non-Human Identity (NHI)

• Design and implement identity and access controls for agents and automation, including:
  • Short-lived credentials and scoped permissions
  • Clear separation between human and non-human access
  • Strong binding of identity to task context and execution
• Ensure all AI actions are attributable and auditable.

Observability & Detection

• Implement logging and tracing for AI activity:
  • Prompts, tool usage, and decision flows
• Build detection capabilities using:
  • Behavioral baselining and anomaly detection techniques
• Identify and alert on:
  • Abnormal tool usage
  • Suspicious prompt patterns
  • Unexpected data access

Threat Modeling (MAESTRO)

• Perform agentic system threat modeling using MAESTRO, including:
  • Mapping agent capabilities, trust boundaries, and attack paths
  • Modeling misuse and adversarial scenarios
• Translate findings into practical safeguards and detection logic.

Developer Safeguards

• Protect developers using AI tools by:
  • Preventing sensitive data exposure
  • Validating AI-generated code and actions
  • Constraining unsafe automation
• Enable safe usage of AI‑assisted development tools (e.g., Claude Code, Codex, Cursor) with:
  • Security validation layers
  • Controlled prompting and output handling patterns

The Right Fit

• 7+ years in security engineering or backend systems
• Proven experience designing and deploying security controls, such as:
  • Runtime enforcement layers (proxies, middleware, policy engines)
  • Identity and access systems, especially for non-human entities
• Strong programming skills (Python preferred; Go, Java, or TypeScript a plus)
• Experience using AI‑assisted development tools such as Claude Code in real workflows, including understanding associated security risks and safeguards
• Experience with:
  • Logging, monitoring, and detection systems
  • Building or securing API/service interactions
• Practical familiarity with:
  • Agentic AI systems or tool-integrated LLM workflows
  • OWASP guidance for AI/agent risks

Practitioner Knowledge

• Experience applying (not just referencing):
  • OWASP Agentic AI / LLM risk guidance
  • NIST AI RMF concepts in real systems
  • CSA guidance on workload and machine identity
• Strong understanding of:
  • Zero Trust for non-human identities
  • Secrets management and credential scoping
  • Observability tooling (e.g., OpenTelemetry, ELK)

Bonus Points For

• Experience securing internal AI platforms or developer‑facing AI tools
• Background in detection engineering, threat hunting, or adversarial testing
• Familiarity with agent frameworks (e.g., LangChain, LlamaIndex)
• Experience mentoring engineers and guiding secure design

We are proud to be an Equal Opportunity Employer.

We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education.