AI Security Engineer — Governance & Risk (Oregon Onsite)

Cybersecurity Jobs; Portland (OR); On-site; USD 160,000 - 260,000; Full time

Benefits offered by this job

Health insurance

Mental health benefits

PTO and holidays

401(k) with company contributions

Parental leave

HSA/FSA options

Employee Assistance Program (EAP)

Job summary

Cetera Financial Group is seeking an experienced Principle Security Engineer to help operationalize AI risk and compliance in a regulated financial services environment. This role focuses on embedding AI governance controls, managing AI third-party and vendor risk, and leading adversarial threat modeling for AI/ML systems using MITRE ATLAS.

Based in Oregon (onsite), this position will translate technical findings into audit-ready documentation while partnering across IT Risk, Cloud Security,

Qualifications

• Minimum 10+ years of IT/cyber risk, GRC, security engineering, or related discipline with AI/ML exposure.
• Experience with AI risk management frameworks and risk documentation for audits/regulatory exams.
• Proficient in threat modeling methodologies for AI/ML systems, including MITRE ATT&CK and MITRE ATLAS.

Responsibilities

• Operationalize AI governance controls and produce control documentation, RCMS, and evidence for audits.
• Lead third-party AI/ML risk management, evaluating vendors, SLAs, and data provenance.
• Maintain AI risk inventories, documenting models, datasets, APIs, and provenance.

Skills

AI risk knowledge

Communication

IT/cyber risk

GRC

Tools

MITRE ATLAS

MITRE ATT&CK

NIST AI RMF

OWASP Top 10 for LLMs

FINRA

Archer

ServiceNow GRC

GRC platforms

AWS Bedrock

Job description

Cetera Financial Group is seeking an experienced Principle Security Engineer to help operationalize AI risk and compliance in a regulated financial services environment. This role focuses on embedding AI governance controls, managing AI third-party and vendor risk, and leading adversarial threat modeling for AI/ML systems using MITRE ATLAS.

Based in Oregon (onsite), this position will translate technical findings into audit-ready documentation while partnering across IT Risk, Cloud Security,