Senior AI/ML Product Security Engineer (Remote)

Norstella; Richmond (VA); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical benefits

HSA/FSA

Dental & Vision

401k

Parental leave

PTO & holidays

Job summary

Norstella is seeking a Senior Product Security Engineer to lead multi‑product security efforts across the Forge platform and Sage KB ecosystem. You will mentor engineers, coordinate incident response, and embed security guardrails into the autonomous SDLC, ensuring AI‑generated code meets HIPAA, GDPR, SOC 2, and FDA 21 CFR Part 11 standards.

The role focuses on securing the end‑to‑end agentic SDLC, including prompts, data, and generated code, across multi‑cloud deployments with a strong emphasis

Qualifications

• BA/BS degree or equivalent experience with a security focus.
• Certifications such as CISSP, OSWE, or cloud security specialties preferred.
• AI/ML security credentials (e.g., AI Security Institute, MLSecOps, or equivalent) a strong plus.

Responsibilities

• Leads threat modelling across complex architectures, including agent‑to‑agent communication graphs and prompt/RAG pipelines.
• Leads secure development training across product groups and evolves standards based on industry trends and OWASP LLM Top10.
• Leads vulnerability management for multiple products and tunes SAST/SCA gating and triage‑LLM classification logic.
• Leads supply chain risk assessments and drives API governance across product portfolios, including AI/ML supply chain components.
• Leads security integration across CI/CD and multi‑cloud platforms, mentoring engineers on automation and audit trails.

Education

BA/BS degree or equivalent experience

Job description

Norstella is seeking a Senior Product Security Engineer to lead multi‑product security efforts across the Forge platform and Sage KB ecosystem. You will mentor engineers, coordinate incident response, and embed security guardrails into the autonomous SDLC, ensuring AI‑generated code meets HIPAA, GDPR, SOC 2, and FDA 21 CFR Part 11 standards.

The role focuses on securing the end‑to‑end agentic SDLC, including prompts, data, and generated code, across multi‑cloud deployments with a strong emphasis