Lead AI Security Engineer: Defend Agentic Platform

EY; Wichita (KS); Remote; USD 125,000 - 230,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking an AI Security Engineer to own EY’s Agentic AI platform security end to end, spanning cloud-native and agentic threat models. The role emphasizes defense against prompt injections, sandboxing, supply-chain integrity, and policy-as-code controls.

The ideal candidate has deep Kubernetes security experience, hands-on AI security work, and a track record of security reviews with clients and regulators. Remote work within the US is supported.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or a related technical field.
• 10+ years in security engineering, security engineering, or offensive security with hands-on ownership.
• Demonstrable depth in cloud-native and Kubernetes security in production environments.
• Hands-on experience with workload identity and secrets management, PKI and lifecycle.
• Practical experience securing AI/ML systems in production, including prompt injection risks.
• Threat modelling capability applied to real systems with measurable controls.
• Proven track record delivering under compliance with audit-grade evidence.
• Experience defining ownership boundaries and control contracts with platform, data, runtime, and delivery teams.

Responsibilities

• Own the platform threat model, covering agent autonomy, tool invocation, and multi-tenancy.
• Define security engineering & control set for infrastructure, Kubernetes, identity, and data.
• Set the secure-by-default contract with templates, sandboxing, and network policy.
• Defend against agentic threat classes including prompt injection and tool abuse.
• Define the agent authority model with delegation limits and non-escalation invariants.
• Own sandboxing standards for agent-generated code execution and isolation.
• Secure model & knowledge supply chain: provenance, SBOM, and integrity.
• Secure agent-to-agent protocols and inter-agent call authorization.
• Lead AI red teaming and adversarial testing before client/regulator reviews.
• Own end-to-end supply-chain integrity and artifact signing/verification.
• Own admission & runtime policy with policy-as-code (Kyverno/OPA).
• Define Kubernetes hardening baselines: CIS standards, network default-deny.
• Ensure tenant isolation across compute, network, storage, and telemetry.
• Serve as security authority in client engagements with CISO/regulator audiences.
• Drive security detection & response: telemetry, alerts, and incident playbooks.

Skills

Cloud-native security

Kubernetes security

Threat modelling

Zero-trust foundations

Policy-as-code

AI and agentic threat models

Red teaming / adversarial testing

Security engineering leadership

Education

Bachelor’s or Master’s degree in CS/Security or related field

Tools

SPIFFE/SPIRE

PKI / certificate lifecycle

Sigstore/Cosign

Kyverno / OPA

Job description

EY is seeking an AI Security Engineer to own EY’s Agentic AI platform security end to end, spanning cloud-native and agentic threat models. The role emphasizes defense against prompt injections, sandboxing, supply-chain integrity, and policy-as-code controls.

The ideal candidate has deep Kubernetes security experience, hands-on AI security work, and a track record of security reviews with clients and regulators. Remote work within the US is supported.