Senior AI/ML Security Engineer — Remote

Norstella; Boise (ID); Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Medical and prescription benefits

HSA/FSA

401k with company match

Paid leave

Job summary

Norstella is seeking a Senior Product Security Engineer focused on AI/ML to lead multi‑product security, incident response, and DevSecOps for Forge and Sage ecosystems. You will embed guardrails across the autonomous SDLC, secure prompts and data, and align with HIPAA, GDPR, SOC 2, and FDA 21 CFR Part 11.

You will mentor engineers, shape threat models, and drive governance across CI/CD and cloud environments, ensuring auditable decision logs and robust risk management.

Qualifications

• Bachelor’s degree or equivalent; security certifications preferred (CISSP/OSWE).
• 4+ years in multi‑product security, with AI/LLM experience in production.
• Strong SDLC risk management and secure design skills across teams.
• Experience enabling CI/CD and cloud security for containerised runtimes.
• Familiarity with SOC 2, HIPAA, GDPR, and FDA/trusted frameworks.

Responsibilities

• Lead threat modelling across agentic architectures and prompt pipelines.
• Drive secure development training and establish standards for AI workflows.
• Manage vulnerability programs and automate gatekeeping for AI code.
• Oversee AI/ML supply chain risk and API governance.
• Ensure auditable, reconstructible logs and SOC2/HIPAA/GDPR compliance.
• Act as IR lead for cross‑product incidents and disclosures.

Skills

AI/ML security

Threat modelling

Secure SDLC

Incident response

Security governance

Python/TypeScript

SOC 2/HIPAA/GDPR

Mentoring teams

Education

BA/BS or equivalent

CISSP / OSWE certification

AI/ML security credentials

Tools

AWS

GCP

Azure

Snyk

LangGraph

CrewAI

Autogen

Semantic Kernel

Job description

Norstella is seeking a Senior Product Security Engineer focused on AI/ML to lead multi‑product security, incident response, and DevSecOps for Forge and Sage ecosystems. You will embed guardrails across the autonomous SDLC, secure prompts and data, and align with HIPAA, GDPR, SOC 2, and FDA 21 CFR Part 11.

You will mentor engineers, shape threat models, and drive governance across CI/CD and cloud environments, ensuring auditable decision logs and robust risk management.