Senior AI Security Platform Lead

EY; Grand Rapids (MI); Remote; USD 150,000 - 210,000; Full time

Job summary

EY is seeking an AI Security Engineer to own the security posture of EY's Agentic AI platform end to end. The role covers threat modeling, cloud-native security, Kubernetes hardening, supply-chain integrity, and prompt-injection defense across diverse deployment targets.

The ideal candidate is a principal security engineer with depth in AI threat models, who can write threat models, perform red-team exercises, define policy-as-code, and defend the system to clients CISO or regulator.

Qualifications

• Expert in cloud-native security for AI platforms.
• Experience with threat modeling across complex platforms.
• Proficient in policy-as-code and Kubernetes hardening.
• Red team and adversarial testing experience.
• Familiarity with supply-chain security and attestation.

Responsibilities

• Own the platform threat model across agent autonomy, tool invocation, delegated authority, and data supply chain.
• Define security controls for all platform layers including infrastructure, Kubernetes, identity, and secure execution.
• Lead defense against agentic threat classes including prompt injection and tool abuse.
• Define agent authority models and sandboxing standards for code execution.
• Manage supply-chain integrity, SBOM attestation, and vulnerability governance.
• Serve as security authority in client engagements and regulator discussions.

Skills

Threat modeling

Cloud security

Kubernetes security

Red teaming

Policy as code

Supply chain security

Tools

Sigstore/Cosign

Notation

Kyverno

OPA

Job description

EY is seeking an AI Security Engineer to own the security posture of EY's Agentic AI platform end to end. The role covers threat modeling, cloud-native security, Kubernetes hardening, supply-chain integrity, and prompt-injection defense across diverse deployment targets.

The ideal candidate is a principal security engineer with depth in AI threat models, who can write threat models, perform red-team exercises, define policy-as-code, and defend the system to clients CISO or regulator.