Lead AI Security Engineer — Platform Threat Defense

EY; Portland (OR); Remote; USD 126,000 - 251,000; Full time

Benefits offered by this job

Medical and dental coverage

401(k) plan

Flexible vacation policy

Job summary

EY is seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. You will shape threat models, enforce zero‑trust, and lead red‑team exercises across cloud, Kubernetes, and agent-based execution.

You’ll collaborate with architecture, security, and client teams to deliver audit‑grade security in regulated environments. The role emphasizes policy‑as‑code, supply‑chain integrity, and defense against prompt injection and authority escalation.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or related field.
• 10+ years in security engineering or offensive security with production ownership.
• Hands-on security of cloud-native platforms and AI systems.

Responsibilities

• Own the platform threat model across multi‑tenancy and agentic components.
• Define security controls for infra, Kubernetes, identity, and data.
• Lead AI red teaming, guardrails, and governance with clients/regulators.
• Manage supply-chain integrity, SBOMs, signing, and attestation.
• Drive policy‑as‑code with Kyverno, OPA, and admission controls.
• Ensure tenant isolation and secure execution of agent‑generated code.

Skills

Cloud-native security

AI threat models

Zero-trust

Policy-as-code

Software supply‑chain security

Threat modeling

Red team / adversarial testing

Security governance

Education

Bachelor’s or Master’s in CS/Security

Tools

SPIFFE/SPIRE

Vault/OpenBao

Sigstore/Cosign

Kubernetes

OPA/Kyverno

Job description

EY is seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. You will shape threat models, enforce zero‑trust, and lead red‑team exercises across cloud, Kubernetes, and agent-based execution.

You’ll collaborate with architecture, security, and client teams to deliver audit‑grade security in regulated environments. The role emphasizes policy‑as‑code, supply‑chain integrity, and defense against prompt injection and authority escalation.