AI Security Engineer

Buchalter; Los Angeles (CA); On-site; USD 130,000 - 180,000; Full time

Job summary

Buchalter in Los Angeles is seeking an AI Security Engineer to engineer, implement, validate, and continuously monitor security controls for Firm-approved AI technologies across platforms and integrations.

The role translates governance, privacy, and cybersecurity requirements into enforceable safeguards, conducting security reviews, threat modeling, and validation prior to production, while partnering with Legal, Risk, Privacy, and business stakeholders throughout the technology lifecycle.

Qualifications

• Bachelor's degree or equivalent in a relevant field and 3+ years of hands-on cybersecurity experience.
• Experience securing cloud applications, APIs, AI-enabled technologies, or complex enterprise integrations.
• Experience with threat modeling, control validation, vulnerability assessments, and security testing.

Responsibilities

• Perform technical security reviews of AI platforms, models, agents, connectors, APIs, and automation.
• Document data flows, identities, permissions, trust boundaries, data residency, retention, logging and exposure paths.
• Engineer and implement controls for access restriction, data protection, secrets management, and monitoring.
• Develop reusable security requirements, reference patterns, and validation procedures for AI-enabled tech.
• Validate security configurations and control effectiveness before production deployment.
• Ensure access controls, logging, rollback, and emergency disablement are operational before deployment.
• Protect attorney-client privileged information and client confidential data in AI-enabled systems.
• Evaluate data handling by AI providers/models and enforce matter-centric access controls and information barriers.
• Analyze user/service/agent identities to enforce least privilege across environments.
• Monitor AI risk, governance, and continuous assurance; maintain inventories and risk assessments.
• Document test scope, results, remediation, and deployment recommendations.

Skills

Information Security

Application Security

Cloud Security

Identity and Access Management

Data Protection

API Security

Secrets Management

Secure Engineering

Education

Bachelor's degree in Cybersecurity/Computer Science/Information Technology

Job description

The AI Security Engineer is responsible for engineering, implementing, validating, and continuously monitoring the technical security controls applied to Firm-approved artificial intelligence technologies. The position translates AI governance, privacy, risk, information governance, client confidentiality, and cybersecurity requirements into enforceable safeguards and repeatable engineering patterns.

Reporting to the Cybersecurity Operations Manager, this hands-on role serves as a technical security specialist for AI platforms, models, agents, copilots, retrieval-augmented generation solutions, connectors, plugins, APIs, application integrations, automation, and supporting infrastructure. The role partners closely with Cybersecurity Operations, Applications and Development, Digital Transformation, Network Operations, Legal, Risk, Privacy, Information Governance, Records, and business stakeholders throughout the technology lifecycle.

The role owns technical security analysis and control validation for assigned AI implementations and recommends deployment conditions, restrictions, or remediation when material risks are identified. It does not independently establish enterprise AI strategy, approve business use cases, negotiate contracts, authorize exceptions, or accept residual business risk. Unresolved concerns are escalated through established governance and risk-management channels.

ESSENTIAL FUNCTIONS AND RESPONSIBILITIES:

AI Security Engineering and Secure Implementation

• Perform technical security reviews of AI platforms, models, agents, copilots, retrieval-augmented generation solutions, connectors, plugins, APIs, automation, and supporting infrastructure.
• Document data flows, identities, permissions, trust boundaries, retrieval sources, external dependencies, data residency, retention, deletion, logging capabilities, and potential exposure pathways.
• Engineer and implement controls for access restriction, data protection, secrets management, environment isolation, monitoring, secure configuration, and administrative governance.
• Develop reusable security requirements, reference patterns, implementation checklists, and validation procedures for AI-enabled technologies.
• Validate security-relevant configuration and control effectiveness before production deployment and following material changes.
• Confirm that required access controls, data protections, logging, monitoring, support procedures, rollback mechanisms, and emergency disablement capabilities are operational before deployment.

Client Data and Legal Services Protection

• Engineer and validate safeguards that protect attorney-client privileged information, attorney work product, client confidential information, personnel information, and other sensitive Firm data used by or accessible to AI-enabled systems.
• Evaluate whether AI providers, models, connectors, plugins, agents, and integrations retain, reuse, disclose, transfer, or train on Firm or client information.
• Support matter-centric access controls, role-based access, ethical walls, information barriers, data-classification requirements, retention standards, and client-specific security obligations.
• Identify configurations or use cases that could result in unauthorized commingling, disclosure, processing, transfer, or persistence of Firm or client information.
• Partner with Legal, Privacy, Risk, Information Governance, Records, and business stakeholders to convert applicable requirements into technical controls and validation evidence.
• Support legal hold, records-management, electronic-discovery, and defensible retention requirements when applicable to an approved AI solution.

Identity, Authorization, and Agent Security

• Analyze user, service, workload, and agent identities to ensure permissions are limited to approved data, tools, actions, users, matters, and environments.
• Validate delegated and application permissions, authorization inheritance, privilege escalation paths, impersonation risks, service principals, managed identities, and connector access.
• Implement or validate safeguards for agentic workflows, including human approval checkpoints, restricted tool access, action boundaries, transaction limits, safe failure behavior, auditable activity, and emergency disablement.
• Confirm that AI agents and integrations cannot bypass existing role-based access controls, ethical walls, information barriers, or application-level permissions.
• Validate credential storage, token handling, key rotation, secrets management, revocation, and least-privilege administration.

AI Risk, Governance, and Continuous Assurance

• Provide technical security analysis for AI use-case and vendor evaluations managed by the Cybersecurity Operations Manager and established governance stakeholders.
• Maintain technical inputs for AI inventories, architecture records, risk assessments, approval evidence, control mappings, exceptions, and reassessment activities.
• Define reassessment triggers for changes involving models, providers, system prompts, retrieval sources, connectors, permissions, data access, integrations, tools, hosting, or use cases.
• Monitor relevant AI security developments and translate applicable threats, standards, control guidance, and lessons learned into practical recommendations.
• Perform periodic testing and evidence collection to confirm that approved AI solutions continue to operate within established requirements.
• Track findings by severity, owner, remediation target, disposition, and closure evidence.

Threat Modeling, Security Testing, and Red Teaming

• Conduct threat modeling and abuse-case analysis for AI-enabled workflows, applications, retrieval sources, agents, tools, and integrations.
• Develop repeatable tests for direct and indirect prompt injection, sensitive-data disclosure, retrieval manipulation or poisoning, unauthorized tool use, excessive agency, cross-user or cross-matter exposure, system-instruction disclosure, insecure output handling, and compromised dependencies.
• Coordinate adversarial testing or targeted AI security exercises for higher-risk implementations.
• Establish baseline and regression testing following material changes to models, prompts, retrieval sources, connectors, tools, permissions, providers, and integrations.
• Document test scope, results, findings, residual risks, remediation requirements, exceptions, and deployment recommendations.
• Evaluate risks created when AI-generated output is consumed by downstream applications, used to initiate actions, or incorporated into consequential business workflows.

Monitoring, Detection, and Incident Response

• Define logging, telemetry, retention, alerting, and investigation requirements for AI-enabled systems.
• Develop AI-specific detection use cases, alert thresholds, triage procedures, and incident-response playbooks.
• Integrate relevant AI telemetry into established security monitoring and incident-management processes where technically supported.
• Support investigation and forensic analysis involving AI platforms, integrations, development systems, software supply-chain concerns, compromised credentials, unauthorized data access, or unintended agent actions.
• Support containment actions, including disabling connectors, revoking credentials, restricting permissions, suspending agents, blocking data access, or isolating affected integrations.
• Preserve available prompts, outputs, tool calls, authentication events, administrative activity, and configuration changes necessary for investigation.
• Perform post-incident control validation and incorporate lessons learned into standards, playbooks, testing, and engineering patterns.

Third-Party AI and Software Supply-Chain Security

• Evaluate technical security characteristics of AI providers and third parties, including data use, model-training practices, retention, deletion, encryption, administrative access, tenant isolation, subprocessors, hosting locations, logging, and incident-notification capabilities.
• Assess third-party models, libraries, packages, plugins, connectors, APIs, containers, artifacts, and development dependencies for security and supply-chain risk.
• Document required technical safeguards, integration conditions, monitoring requirements, service dependencies, and provider-side limitations.
• Support technical due diligence, security questionnaires, architecture reviews, reassessments, and provider exit or data-removal planning.
• Coordinate with Legal, Privacy, Procurement, Risk, application owners, and vendors while clearly documenting technical findings and recommended safeguards.

Secure AI Development Support

• Evaluate risks introduced by AI-generated code, automated code changes, development agents, model context, tool permissions, third-party dependencies, and software artifacts.
• Define security requirements for AI-assisted development, including human review, change control, testing, approval, traceability, rollback, and segregation of duties.
• Integrate appropriate checks into source control and CI/CD workflows, including secret detection, dependency analysis, code analysis, infrastructure-as-code review, artifact scanning, and policy validation.
• Partner with developers and application owners to remediate findings and improve secure coding, integration, testing, and deployment practices.
• Automate repeatable security validation, evidence collection, configuration review, and monitoring tasks where practical.

Vulnerability and Risk Management

• Identify, assess, prioritize, and support remediation of vulnerabilities and security weaknesses within assigned AI technologies, cloud services, applications, APIs, and integrations.
• Coordinate remediation with Network Operations, Applications and Development, vendors, and other technology teams.
• Validate corrective actions, document closure evidence, and support ongoing risk-reduction initiatives.
• Assist with vulnerability assessments, penetration tests, security reviews, exception management, and remediation tracking.

Documentation, Collaboration, and Knowledge Sharing

• Develop and maintain security standards, requirements, threat models, data-flow and trust-boundary diagrams, test plans, results, runbooks, architecture records, decision records, and implementation evidence.
• Produce clear findings, risk statements, technical recommendations, remediation requirements, and deployment conditions for technical and non-technical audiences.
• Provide practical guidance to cybersecurity, development, applications, legal, privacy, risk, vendors, and business stakeholders.
• Participate in cross-training, knowledge sharing, tabletop exercises, and continuous improvement across Cybersecurity Operations and partner teams.
• Support general cybersecurity engineering, incident response, risk reduction, and technology implementation activities as operational priorities require.

Other Duties

• Perform other cybersecurity-related duties as assigned to support Firm operations and growth.

REQUIRED SECURITY DELIVERABLES:

• Technical security assessments and deployment recommendations.
• Threat models, abuse cases, data-flow diagrams, and trust-boundary diagrams.
• Security requirements, reference patterns, implementation checklists, and control mappings.
• Test plans, regression tests, results, findings, remediation records, and closure evidence.
• Logging, monitoring, detection, and incident-response requirements and playbooks.
• AI inventory, architecture, exception, reassessment, and approval-support records.
• Secure configuration baselines, operational runbooks, and emergency disablement procedures.

KEY OUTCOMES:

• AI security reviews are completed consistently using documented standards, repeatable methods, and retained evidence.
• Material AI risks are identified and escalated before production deployment or continued operation.
• Approved AI solutions have validated identity, access, data-protection, logging, monitoring, incident-response, rollback, and disablement controls appropriate to their risk.
• Reusable security patterns improve consistency and reduce unnecessary effort across implementations.
• Security findings have clear owners, remediation plans, dispositions, and closure evidence.
• Material technology changes trigger timely reassessment and regression testing.
• AI-related incidents can be investigated using available, reliable, and appropriately retained telemetry.
• Technical standards remain aligned with approved Firm governance, cybersecurity, privacy, information-governance, records, and client requirements.

KNOWLEDGE, SKILLS, AND ABILITIES REQUIRED:

• Strong understanding of information security, application security, cloud security, identity and access management, data protection, API security, secrets management, and secure engineering practices.
• Working knowledge of AI and generative AI architectures, including models, agents, retrieval-augmented generation, embeddings, APIs, connectors, plugins, orchestration, data flows, and third-party dependencies.
• Ability to analyze permissions, trust boundaries, authorization paths, data handling, logging, and integration risk across complex enterprise environments.
• Knowledge of AI security and risk guidance, such as the NIST AI Risk Management Framework, OWASP guidance for AI and large language model applications, and secure software development practices.
• Practical knowledge of source control, CI/CD, code analysis, dependency analysis, secrets management, infrastructure as code, containers, artifacts, and deployment pipelines.
• Strong technical writing, threat modeling, troubleshooting, analytical, and communication skills.
• Ability to translate governance, legal, privacy, information-governance, records, and risk requirements into technical controls.
• Ability to collaborate across cybersecurity, infrastructure, development, applications, legal, privacy, risk, vendors, and business teams.
• Ability to manage multiple assessments and remediation efforts while maintaining accurate documentation and timely escalation.

Relevant Technology Environment

Relevant experience may include Microsoft Azure, Microsoft 365, Microsoft Entra ID, Microsoft Purview, Microsoft Defender, Microsoft Copilot, Copilot Studio, Azure AI services, Power Platform, GitHub, Azure DevOps, source-control and CI/CD platforms, security monitoring and vulnerability-management platforms, document-management systems, records-management systems, legal applications, and comparable enterprise technologies. Experience with every listed platform is not required.

SUPERVISORY RESPONSIBILITY:

Not applicable.

INTERPERSONAL CONTACTS:

Has regular contact with others both inside and outside of the Firm. Common contacts include IT staff and managers, attorneys, administrative staff, Legal, Risk, Privacy, Information Governance, Records, business stakeholders, clients as appropriate, and external vendors. Contacts may include discussion of confidential, privileged, proprietary, personal, or otherwise sensitive information.

WORKING CONDITIONS

• Normal office working conditions.
• Position is full-time, generally 40 or more hours per week.
• Scheduled or unscheduled work outside normal business hours may be required to support cybersecurity incidents, urgent remediation, production changes, or critical Firm operations.
• Work may require occasional travel among the various offices.
• Regular exposure to computers.
• Physical ability to engage in repetitive motions of fingers and hands, to hear, and to see, with or without reasonable accommodation.

EDUCATION/EXPERIENCE:

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Software Engineering, or a related field, or equivalent combination of education and relevant experience.
• Three or more years of highly relevant hands‑on experience in cybersecurity engineering, application security, cloud security, security architecture, DevSecOps, or a closely related technical discipline.
• Demonstrated experience securing cloud applications, APIs, AI-enabled technologies, development environments, or complex enterprise integrations.
• Experience conducting technical security reviews, threat modeling, control validation, secure implementation reviews, vulnerability assessments, or security testing.
• Experience documenting technical findings, control requirements, remediation actions, and validation evidence.
• Experience using scripting or development languages to automate technical or security tasks.

Preferred Qualifications

• Five or more years of progressive experience in cybersecurity engineering, application security, cloud security, security architecture, DevSecOps, or a related technical discipline.
• Experience securing generative AI, machine-learning, retrieval-augmented generation, copilots, or agentic systems.
• Experience with Microsoft cloud, identity, security, compliance, AI, development, or automation platforms.
• Experience integrating security controls and validation into source control and CI/CD workflows.
• Experience supporting incident response or forensic analysis involving cloud applications, APIs, source code, software dependencies, or AI-enabled systems.
• Experience in a law firm, professional‑services organization, financial institution, or another highly regulated environment.

Preferred Certifications

• Security+, CySA+, Microsoft AZ-500, Microsoft SC-100, CCSP, or equivalent security, cloud, or architecture certification.

Application security, secure software development, DevSecOps, Microsoft identity, security, compliance, Azure, or recognized AI security and risk training.