Senior AI Security Architect: Platform Defense

EY; Sacramento (CA); On-site; USD 126,000 - 230,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off

Flexible vacation policy

Job summary

EY is seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. The role spans cloud-native security, tooling, and risk governance, including threat modelling, containment, and audit-grade evidence for regulated environments.

The ideal candidate brings 10+ years in security engineering, hands-on AI security experience, and a pragmatic approach to incident response, identity management, and SBOM governance.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or related field.
• 10+ years in security engineering, security engineering, or offensive security, including hands-on production ownership.
• Practical experience securing AI or ML systems in production, including familiarity with prompt injection, tool abuse, excessive agency, and model or data supply-chain risk.

Responsibilities

• Own the platform threat model: covering agent autonomy, tool invocation, delegated authority, model and data supply chain, multi-tenancy, and every deployment target from cloud to air-gapped, and keep it current as the platform evolves through each build phase.
• Define the security engineering and control set for every platform layer: infrastructure and boot chain, Kubernetes and cluster fabric, identity and secrets, secure execution and sandboxing, gateway and egress, data and state, delivery pipeline, and telemetry.
• Set the secure-by-default contract so that platform capabilities arrive hardened, including agent templates, Helm charts, sandbox profiles, and network policy ship with correct controls rather than requiring teams to add them.
• Own defense against agentic threat classes including direct and indirect prompt injection, jailbreak and instruction hijacking, excessive agency, confused-deputy and authority-escalation attacks, tool and function-call abuse, memory and context poisoning, and retrieval-augmented data exfiltration.
• Work with the architecture team to help define the agent authority model: delegated and on-behalf-of authority, scope and delegation-depth limits, consent boundaries, and the non-escalation invariant that an agent never exceeds the authority of its initiating principal at any hop.
• Own the sandboxing security standard for agent-generated code execution: isolation boundaries, filesystem and credential scope, egress restriction, resource containment, and the escape-test suite that proves the boundary holds.

Skills

Cloud-native security

AI/agentic threat models

Zero-trust architecture

Policy-as-code

Threat modelling

Incident response

Education

Bachelor’s or Master’s degree in Computer Science, Security, or related field

Tools

SPIFFE/SPIRE

PKI & certificate lifecycle

Sigstore/Cosign

SBOM and supply-chain tooling

Job description

EY is seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. The role spans cloud-native security, tooling, and risk governance, including threat modelling, containment, and audit-grade evidence for regulated environments.

The ideal candidate brings 10+ years in security engineering, hands-on AI security experience, and a pragmatic approach to incident response, identity management, and SBOM governance.