Senior AI/ML Product Security Engineer — Remote

Norstella; Salt Lake City (UT); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical benefits

Health savings account

Dental & Vision benefits

401k with company match

Paid time off

Job summary

Norstella is seeking a Senior Product Security Engineer to lead multi-product security efforts, mentor the Forge/AI teams, and embed guardrails across the autonomous SDLC. You will champion threat modelling, incident response, and supply-chain governance for the Forge platform and Sage KB ecosystem.

This role focuses on HIPAA, GDPR, SOC 2, and FDA 21 CFR Part 11 compliance in a remote-first US environment. You will collaborate with cross-functional teams to secure AI-generated code, manage

Qualifications

• 4+ years in multi-product security programs with AI/ML exposure.
• Strong SDLC risk management across teams and secure design mentoring.
• Experience with CI/CD, cloud, containers, and GPU endpoints.
• Familiarity with SOC 2, HIPAA, GDPR, FDA 21 CFR Part 11.

Responsibilities

• Lead threat modelling across complex architectures and mentor engineers.
• Lead secure development training across product groups and evolve standards.
• Oversee vulnerability management and triage with auto-remediation loops.
• Own AI/ML supply chain risk assessments and API governance.
• Ensure audit trails and compliance across SOC 2, HIPAA, GDPR, FDA rules.
• Coordinate incident response leadership and cross-product IR efforts.
• Institute SSDLC governance and enforce safe design principles.
• Instrument observability and tracing across agent execution graphs.

Skills

Threat modelling

Security leadership

CI/CD security

AI/ML security

OWASP LLM Top10

Vulnerability management

Incident response

Cloud security

Education

BS in CS/Engineering

Tools

LangGraph

CrewAI

Autogen

Semantic Kernel

MCP

Job description

Norstella is seeking a Senior Product Security Engineer to lead multi-product security efforts, mentor the Forge/AI teams, and embed guardrails across the autonomous SDLC. You will champion threat modelling, incident response, and supply-chain governance for the Forge platform and Sage KB ecosystem.

This role focuses on HIPAA, GDPR, SOC 2, and FDA 21 CFR Part 11 compliance in a remote-first US environment. You will collaborate with cross-functional teams to secure AI-generated code, manage