AI Security Analyst

Confidential; United States; Hybrid; USD 120,000 - 170,000; Full time

Job summary

Confidential is seeking an AI Security Analyst to evaluate security risks across AI platforms, integrations, and agentic AI capabilities. You will recommend controls, guide secure AI architecture, and support responsible adoption while protecting data, systems, and users.

You will work with AI platform teams, security leadership, and business stakeholders to assess risks, ensure robust authentication and API security, and align with regulatory requirements.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Engineering, or related field (equivalent experience considered).
• Minimum of 3 years of experience in cybersecurity, application security, cloud security, or another technical security role.
• Hands-on experience with AI/ML systems, large language model applications, AI platforms, data pipelines, or related technologies.
• Strong understanding of secure coding, authentication, authorization, API security, cloud security, and data protection.
• Familiarity with adversarial machine learning concepts, model security, AI threats, and AI risk management.

Responsibilities

• Evaluate security risks across AI platforms, integrations, connectors, plugins, and agentic AI capabilities.
• Recommend security controls, compensating controls, risk mitigations, and go/no-go decisions.
• Advise teams on secure AI architecture, data access, authentication, authorization, and API security.
• Evaluate vendor and third-party AI risk, including data processing agreements and SOC 2.
• Ground security recommendations in NIST AI RMF, OWASP Top 10 for LLM and Agentic Apps, MITRE ATLAS.
• Monitor evolving AI security threats and platform changes; update guidance.
• Help build secure AI knowledge and advisory capabilities within the Information Security team.

Skills

AI security

Adversarial ML

Risk assessment

Communication

Cloud security

Identity & access

Education

Bachelor's degree or equivalent

Job description

The AI Security Analyst is responsible for evaluating security risks across artificial intelligence platforms, integrations, connectors, plugins, and agentic AI capabilities. This role recommends security controls and tooling, provides guidance on secure AI architecture, and supports the responsible adoption of AI services while protecting organizational data, systems, and users.

Key Responsibilities

• Evaluate new releases, capabilities, and configurations across AI platforms, including multi-model AI platforms, Microsoft Copilot, ChatGPT EDU, Claude EDU, Google Gemini Enterprise, and agentic AI platforms.
• Assess security risks related to AI integrations, connectors, plugins, MCP servers, APIs, and connections to Microsoft 365, enterprise applications, databases, and other organizational data sources.
• Identify and assess agentic AI risks, including autonomous tool access, standing credentials, excessive permissions, unintended actions, and data exfiltration.
• Provide AI-specific security expertise within the organization’s AI risk assessment process.
• Recommend security controls, compensating controls, risk mitigations, and go/no-go decisions based on system scope, scale, architecture, and data sensitivity.
• Escalate significant security concerns to Information Security leadership and other appropriate stakeholders.
• Advise AI platform, engineering, and business teams on secure AI architecture, platform design, data access, authentication, authorization, and API security.
• Evaluate vendor and third-party AI risk, including data processing agreements, SOC 2 reports, data residency, sub-processors, and data handling practices.
• Recommend security products, processes, and tooling that strengthen the AI ecosystem.
• Develop reusable secure baselines, reference configurations, and guidance for supported AI platforms.
• Ground security recommendations in recognized frameworks, including NIST AI RMF, OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, and MITRE ATLAS.
• Monitor the evolving AI security threat landscape, emerging attack techniques, platform changes, and standards, incorporating relevant updates into assessments and security guidance.
• Help build secure AI knowledge and advisory capabilities across the broader Information Security team.

Minimum Education & Experience Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Engineering, or a related field; equivalent relevant experience may be considered in place of a degree.
• Minimum of 3 years of experience in cybersecurity, application security, cloud security, or another technical security-focused role.
• Hands‑on experience with AI/ML systems, large language model applications, AI platforms, data pipelines, or related technologies.
• Strong understanding of secure coding practices, authentication, authorization, API security, cloud security, and data protection.
• Familiarity with adversarial machine learning concepts, model security, AI threats, and AI risk management.

Special Requirements

• Ability to evaluate sensitive systems, data flows, vendor documentation, and security controls while maintaining confidentiality.
• Successful completion of applicable background checks and organizational employment requirements.
• Relevant security certifications are preferred, including CISSP, GSEC, CSSLP, AWS Security Specialty, or similar credentials.

Knowledge, Skills, and Abilities

• Knowledge of AI and LLM security risks, including prompt injection, insecure output handling, sensitive data disclosure, excessive agency, insecure plugins, model misuse, and data exfiltration.
• Knowledge of cloud security principles and enterprise identity and access management practices.
• Ability to evaluate AI architectures, RAG systems, model‑serving platforms, APIs, connectors, and agentic workflows.
• Strong understanding of authentication, authorization, least‑privilege access, credential management, and secure integration design.
• Ability to conduct risk assessments and translate technical findings into practical business recommendations.
• Strong written and verbal communication skills, with the ability to advise both technical and non‑technical stakeholders.
• Ability to independently prioritize work, manage multiple assessments, and make sound risk‑based decisions.
• Strong analytical, problem‑solving, documentation, collaboration, and attention‑to‑detail skills.
• Ability to stay current with rapidly evolving AI technologies, security threats, vendor capabilities, and regulatory requirements.

Additional Desired Characteristics

• Experience securing generative AI applications, RAG systems, AI gateways, model‑serving platforms, or agentic AI solutions.
• Familiarity with OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, NIST AI RMF, MITRE ATLAS, and related AI security guidance.
• Working knowledge of at least two compliance frameworks, such as FERPA, HIPAA, NIST 800‑53, NIST 800‑171, or SOC 2.
• Experience with privacy, data governance, data classification, regulatory requirements, and vendor risk management.
• Experience reviewing SOC 2 reports, data processing agreements, data residency requirements, and third‑party security documentation.
• Experience supporting security in higher education, research environments, large enterprise environments, or highly regulated organizations.
• Ability to create repeatable security standards, secure configuration baselines, and reference architectures.

This position may operate in an onsite, hybrid, or remote environment based on organizational and departmental needs. The role requires regular collaboration with Information Security, AI platform teams, enterprise technology teams, vendors, and business stakeholders. Occasional flexibility outside standard business hours may be required to support urgent security matters, platform changes, or critical assessments.

Other Duties

This job description is not intended to be an exhaustive list of all duties, responsibilities, qualifications, or working conditions associated with the position. Other duties may be assigned as needed to support the organization’s goals and objectives.