Remote Senior AI/ML Security Engineer

Norstella; Montpelier (VT); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical and prescription benefits

HSA or FSA

401k with company match

Parental leave

PTO & holidays

Job summary

Norstella is seeking a Senior Product Security Engineer focused on AI/ML. You will lead multi‑product security programs, mentor engineers, and embed guardrails into the autonomous SDLC for the Forge platform and Sage KB ecosystem.

You will coordinate incident response, strengthen threat modelling, and align with SOC 2, HIPAA, GDPR, and FDA guidelines across cloud‑based, multi‑product environments.

Qualifications

• Holds a BA/BS degree or equivalent experience; certifications such as CISSP, OSWE, or cloud security specialties preferred.
• Typically 4+ years of experience in multi‑product security programs, with AI/ML or LLM‑powered systems experience in production.
• Strong knowledge of managing SDLC risks across multiple teams and mentoring others in secure design.

Responsibilities

• Lead threat modelling across architectures and mentor engineers in risk analysis practices.
• Drive secure development training across product groups and evolve standards based on industry trends.
• Oversee vulnerability management, set priorities, and tune auto‑remediation loops for safety.

Skills

Threat modelling

Secure SDLC governance

Incident response coordination

DevSecOps integration

AI/ML security governance

Prompt injection defense

Security training & mentoring

Vulnerability management

CI/CD security across multi-cloud

Python/TypeScript coding

Education

BA/BS degree or equivalent

Security certifications (CISSP/OSWE)

Tools

SAST/SCA tooling

OWASP LLM Top 10

LangGraph / CrewAI / Autogen (example)

Job description

Norstella is seeking a Senior Product Security Engineer focused on AI/ML. You will lead multi‑product security programs, mentor engineers, and embed guardrails into the autonomous SDLC for the Forge platform and Sage KB ecosystem.

You will coordinate incident response, strengthen threat modelling, and align with SOC 2, HIPAA, GDPR, and FDA guidelines across cloud‑based, multi‑product environments.