Senior AI Security Engineer - Platform Threat & Defense

EY; Philadelphia (Philadelphia County); Remote; USD 126,000 - 262,000; Full time

Job summary

EY, the global professional services firm, is seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. You will tackle threat modelling, sandboxing, supply-chain integrity, and policy-as-code across cloud-native deployments, from cloud to air-gapped environments, working with architecture and client engagements.

This role demands deep security expertise, AI risk knowledge, and the ability to communicate with CISOs and regulators while delivering

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Security, or related field or demonstrably equivalent depth.
• 10+ years in security engineering with production ownership.
• Demonstrable depth in cloud-native and Kubernetes security.
• Hands-on experience with workload identity and secrets management.
• Practical experience securing AI/ML systems in production, including agentic attack surfaces.
• Threat modelling applied to real systems with verified controls.
• Track record delivering under compliance with audit-grade evidence requirements.
• Experience defining ownership boundaries and control contracts with platform, data, runtime, and delivery teams.

Responsibilities

• Own the platform threat model: covering agent autonomy, tool invocation, delegated authority, model and data supply chain, multi-tenancy, and deployment targets.
• Define the security engineering and control set for every platform layer: infrastructure, Kubernetes, identity, secure execution, gateway, data, telemetry.
• Set the secure-by-default contract with hardened capabilities, including agent templates, Helm charts, sandbox profiles, and network policy.
• Own defense against agentic threat classes including prompt injection, jailbreak, excessive agency, and authority escalation.
• Work with architecture to define the agent authority model: delegation depth, consent boundaries, and non-escalation invariants.
• Own the sandboxing security standard for agent-generated code execution.
• Secure the model and knowledge supply chain: provenance, SBOM, and attestation.
• Secure agent-to-agent and tool protocols: trust, registration, validation, and authorization.
• Lead AI red teaming and adversarial testing before client/auditor exposure.
• Own supply-chain integrity end-to-end: signing, verification, SBOM, provenance, and license governance.
• Own admission and runtime policy: policy-as-code across Kyverno and OPA, and Pod Security Standards.
• Define Kubernetes hardening baselines: CIS-aligned config, default-deny networking, and secret handling standards.
• Own tenant isolation assurance and cross-tenant leakage testing.
• Serve as security authority in client engagements: reviews, regulator responses, and auditable artefacts.
• Drive security detection and response for the platform: telemetry, alerts, and incident response playbooks.

Skills

Cloud-native security

AI threat models

Zero-trust

Policy as code

SBOM provenance

Offensive security

Risk management

Executive communication

Security enablement

Education

Bachelor’s or Master’s in CS/Security

Tools

SPIFFE/SPIRE

Vault/OpenBB (OpenBao)

Sigstore/Cosign

OPA/Kyverno

Job description

EY, the global professional services firm, is seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. You will tackle threat modelling, sandboxing, supply-chain integrity, and policy-as-code across cloud-native deployments, from cloud to air-gapped environments, working with architecture and client engagements.

This role demands deep security expertise, AI risk knowledge, and the ability to communicate with CISOs and regulators while delivering