Cyber - AI Security - Senior - Consulting
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We must include a section only when posting has real, specific content. So we need sections: About the role? The intro paragraphs could be considered "About the role". The posting starts with location line then intro: "At EY, we’re all in to shape your future with confidence...". That's about the role/company. We'll make a section "About the role". Then "Responsibilities" from "Your Key Responsibilities". Then "Skills" from "Skills And Attributes For Success". Then "Qualifications" from "To Qualify for the Role, You Must Have". Then maybe "Preferred Qualifications" from "Ideally, You’ll Also Have". Could combine into Qualifications? But we can have separate sections: Qualifications and Preferred Qualifications. Then "Benefits" from "What We Offer You" includes salary range and benefits. Also "Pay" maybe separate if salary details present. The instruction: Prefer a few substantive sections over many thin ones. But we need to include sections only when content exists. We have salary range specifics, benefits specifics. Could combine Pay and Benefits into one section? But they said use headings like Pay, Schedule, Benefits. If we have both pay and benefits, we could make separate Pay and Benefits sections. However they said prefer few substantive sections over many thin ones. But we have enough content for each.
We also have Schedule? Not mentioned. So we should not create Schedule section.
We need to preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points etc.
We need to convert lists into
- . The responsibilities are a paragraph with many sentences; we could break into list items? The instruction: Use
- for any list of duties/requirements/benefits. The responsibilities are not explicitly a list but could be considered duties. We could format each sentence as a list item. However that might be too granular but still a list. The instruction says "any list of duties/requirements/benefits". The responsibilities section is a list of duties albeit in prose. Safer to treat as
- each duty. Similarly for Skills And Attributes: it's a list of attributes. We'll break each sentence into
- . For Qualifications: also list.
We must not repeat job title as heading. No Job ID etc.
We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. So we need to cut out the EEO statement at end, the "Apply today", "To make the most of your application experience...", "EY accepts applications...", "For those living in California...", the values statement, etc. Also remove the "What We Look For" maybe keep? It's substantive. Keep.
We must keep all substantive info: location line? It says "Location: Anywhere in Country". That's minor metadata; we can fold into short
or drop. Probably include as a short paragraph.
We need to output only HTML fragment.
Let's structure:
Location: Anywhere in Country
About the role
At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.
The Opportunity
Artificial Intelligence (AI) is rapidly transforming how organizations operate, and with that transformation comes an entirely new frontier of security, governance, and risk management challenges. Organizations are grappling with securing AI pipelines, managing model-level risks, operationalizing AI governance programs, and navigating an evolving regulatory landscape specific to AI technologies. As a Senior Consultant within EY’s Cyber practice focused on AI Security, you will work with clients to assess AI risk postures, architect AI security controls, and develop governance frameworks that enable organizations to adopt and scale AI responsibly and securely. This role offers the opportunity to combine hands-on technical implementation work with strategic advisory and architecture engagements across diverse industries.
Responsibilities
- Conduct AI security assessments, evaluate AI/ML pipelines and model infrastructure, identify vulnerabilities inherent to AI systems, and develop practical, prioritized remediation strategies.
- Architect and support the implementation of AI-SPM solutions, configure AI security tooling—including platforms and harnesses—and help clients operationalize continuous monitoring and governance controls across their AI workloads.
- Develop AI governance frameworks, policies, and standards aligned to emerging regulatory requirements and industry guidance.
- Assist clients in designing AI risk management programs, performing AI model risk assessments, and building AI security roadmaps that balance innovation with responsible AI principles.
- Prepare client deliverables, technical architecture documentation, and executive-level presentations that communicate complex AI security concepts to both technical and non-technical audiences.
- Collaborate with multidisciplinary teams to deliver high-quality work products, support project planning and management activities, mentor junior team members, and contribute to business development initiatives, thought leadership, and practice-building efforts within EY’s growing AI security capability.
Skills
- Strong understanding of AI/ML systems, architectures, and deployment patterns, including large language models (LLMs), generative AI, and MLOps pipelines.
- Hands-on experience with AI Security Posture Management (AI-SPM) tools, platforms, and methodologies.
- Ability to identify and assess security risks specific to AI systems, including prompt injection, model poisoning, data exfiltration, supply chain vulnerabilities, and adversarial attacks.
- Experience configuring and operationalizing AI security and DevSecOps tooling, including platforms and harnesses, to enforce security controls within AI development and deployment pipelines.
- Knowledge of AI governance frameworks, responsible AI principles, and emerging AI-specific regulatory requirements.
- Strong critical thinking, analytical, and problem-solving skills applied to complex AI security and risk challenges.
- Ability to communicate technical AI security concepts effectively to both engineering teams and executive stakeholders.
- Experience developing technical architecture documentation, executive presentations, and client-facing deliverables.
- Strong verbal and written communication skills.
- Ability to manage competing priorities in a fast-paced consulting environment.
- Strong attention to detail and commitment to high-quality client service.
- Ability to build relationships and collaborate effectively across multidisciplinary teams and client organizations.
- Demonstrated initiative, adaptability, and a commitment to staying current with the rapidly evolving AI security landscape.
Qualifications
- A bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field, and approximately 3–5 years of relevant experience, including at least 1–2 years in AI or machine learning security; or a graduate degree and 2–4 years of relevant experience.
- Experience in one or more of the following areas:
- AI security assessments, AI-SPM, or AI model risk evaluations
- AI/ML pipeline security, model security, and MLOps security practices
- AI governance, responsible AI policy development, and AI risk management frameworks
- DevSecOps and CI/CD security, including hands-on experience with platforms and harnesses
- Cloud security with specific experience securing AI workloads on platforms such as AWS, Azure, or GCP
- AI regulatory compliance and emerging AI-specific standards and guidance
- Cybersecurity architecture, risk management, and security controls design
- Familiarity with AI security frameworks and guidance, including NIST AI RMF, OWASP Top 10 for LLMs, and MITRE ATLAS
- Working knowledge of foundational cybersecurity frameworks—including NIST CSF, NIST 800-53, and ISO 27001/27002—as applied within AI-enabled environments
- Strong Microsoft PowerPoint, Excel, and Word skills
- Willingness to travel based on client and business needs; travel estimated at 25–50%
But note: The Qualifications section originally had a paragraph then a list of experience areas. We could keep as a with each bullet as a qualification. The inner list could be nested . That's okay.
Preferred Qualifications
- Professional certifications in cybersecurity (e.g., CISSP, CCSP, CISM) or emerging AI/ML security credentials.
- Hands-on experience with AI-SPM platforms, MLOps tooling, and AI security automation technologies.
- Experience with CI/CD orchestration and integrated security tooling, including harnesses, to enforce automated security gates within AI development pipelines.
- Knowledge of adversarial machine learning techniques, model explainability requirements, and AI supply chain risk management.
- Exposure to AI-related regulatory developments, including the EU AI Act, NIST AI RMF, and sector-specific AI guidance applicable to financial services, healthcare, or critical infrastructure.
- Experience facilitating client workshops, technical design sessions, and AI security architecture reviews.
- Background in software development, data engineering, or ML engineering that informs deep technical AI security expertise.
- Experience within a consulting, professional services, or advisory environment.
What We Look For
We are seeking professionals who are deeply curious about the intersection of artificial intelligence and cybersecurity, with the hands-on technical capabilities to assess and architect secure AI systems alongside the advisory acumen to guide organizational AI governance strategies. Successful candidates combine technical depth in AI security with strong business judgment and can engage confidently with both engineering teams and executive stakeholders. The ideal candidate is motivated by the challenge of securing transformative and rapidly evolving technologies, committed to delivering exceptional client outcomes, and eager to help shape and grow EY’s Cyber practice.
Pay
The salary range for this job is:
- New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $125,800 to $209,700
- Bay Area California offices – $131,100 to $218,500
- All other offices locations in the US, including Sacramento – $104,800 to $192,200
- Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography.
Benefits
In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
We should also include the "What We Offer You" intro: "At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers." That's substantive. Could be part of
for prose. We must include a section only when posting has real, specific content. So we need sections: About the role? The intro paragraphs could be considered "About the role". The posting starts with location line then intro: "At EY, we’re all in to shape your future with confidence...". That's about the role/company. We'll make a section "About the role". Then "Responsibilities" from "Your Key Responsibilities". Then "Skills" from "Skills And Attributes For Success". Then "Qualifications" from "To Qualify for the Role, You Must Have". Then maybe "Preferred Qualifications" from "Ideally, You’ll Also Have". Could combine into Qualifications? But we can have separate sections: Qualifications and Preferred Qualifications. Then "Benefits" from "What We Offer You" includes salary range and benefits. Also "Pay" maybe separate if salary details present. The instruction: Prefer a few substantive sections over many thin ones. But we need to include sections only when content exists. We have salary range specifics, benefits specifics. Could combine Pay and Benefits into one section? But they said use headings like Pay, Schedule, Benefits. If we have both pay and benefits, we could make separate Pay and Benefits sections. However they said prefer few substantive sections over many thin ones. But we have enough content for each. We also have Schedule? Not mentioned. So we should not create Schedule section. We need to preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points etc. We need to convert lists into
- . The responsibilities are a paragraph with many sentences; we could break into list items? The instruction: Use
- for any list of duties/requirements/benefits. The responsibilities are not explicitly a list but could be considered duties. We could format each sentence as a list item. However that might be too granular but still a list. The instruction says "any list of duties/requirements/benefits". The responsibilities section is a list of duties albeit in prose. Safer to treat as
- each duty. Similarly for Skills And Attributes: it's a list of attributes. We'll break each sentence into
- . For Qualifications: also list.
We must not repeat job title as heading. No Job ID etc.
We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. So we need to cut out the EEO statement at end, the "Apply today", "To make the most of your application experience...", "EY accepts applications...", "For those living in California...", the values statement, etc. Also remove the "What We Look For" maybe keep? It's substantive. Keep.
We must keep all substantive info: location line? It says "Location: Anywhere in Country". That's minor metadata; we can fold into short
or drop. Probably include as a short paragraph. We need to output only HTML fragment. Let's structure:
Location: Anywhere in Country
About the role
At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.
The Opportunity
Artificial Intelligence (AI) is rapidly transforming how organizations operate, and with that transformation comes an entirely new frontier of security, governance, and risk management challenges. Organizations are grappling with securing AI pipelines, managing model-level risks, operationalizing AI governance programs, and navigating an evolving regulatory landscape specific to AI technologies. As a Senior Consultant within EY’s Cyber practice focused on AI Security, you will work with clients to assess AI risk postures, architect AI security controls, and develop governance frameworks that enable organizations to adopt and scale AI responsibly and securely. This role offers the opportunity to combine hands-on technical implementation work with strategic advisory and architecture engagements across diverse industries.
Responsibilities
- Conduct AI security assessments, evaluate AI/ML pipelines and model infrastructure, identify vulnerabilities inherent to AI systems, and develop practical, prioritized remediation strategies.
- Architect and support the implementation of AI-SPM solutions, configure AI security tooling—including platforms and harnesses—and help clients operationalize continuous monitoring and governance controls across their AI workloads.
- Develop AI governance frameworks, policies, and standards aligned to emerging regulatory requirements and industry guidance.
- Assist clients in designing AI risk management programs, performing AI model risk assessments, and building AI security roadmaps that balance innovation with responsible AI principles.
- Prepare client deliverables, technical architecture documentation, and executive-level presentations that communicate complex AI security concepts to both technical and non-technical audiences.
- Collaborate with multidisciplinary teams to deliver high-quality work products, support project planning and management activities, mentor junior team members, and contribute to business development initiatives, thought leadership, and practice-building efforts within EY’s growing AI security capability.
Skills
- Strong understanding of AI/ML systems, architectures, and deployment patterns, including large language models (LLMs), generative AI, and MLOps pipelines.
- Hands-on experience with AI Security Posture Management (AI-SPM) tools, platforms, and methodologies.
- Ability to identify and assess security risks specific to AI systems, including prompt injection, model poisoning, data exfiltration, supply chain vulnerabilities, and adversarial attacks.
- Experience configuring and operationalizing AI security and DevSecOps tooling, including platforms and harnesses, to enforce security controls within AI development and deployment pipelines.
- Knowledge of AI governance frameworks, responsible AI principles, and emerging AI-specific regulatory requirements.
- Strong critical thinking, analytical, and problem-solving skills applied to complex AI security and risk challenges.
- Ability to communicate technical AI security concepts effectively to both engineering teams and executive stakeholders.
- Experience developing technical architecture documentation, executive presentations, and client-facing deliverables.
- Strong verbal and written communication skills.
- Ability to manage competing priorities in a fast-paced consulting environment.
- Strong attention to detail and commitment to high-quality client service.
- Ability to build relationships and collaborate effectively across multidisciplinary teams and client organizations.
- Demonstrated initiative, adaptability, and a commitment to staying current with the rapidly evolving AI security landscape.
Qualifications
- A bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field, and approximately 3–5 years of relevant experience, including at least 1–2 years in AI or machine learning security; or a graduate degree and 2–4 years of relevant experience.
- Experience in one or more of the following areas:
- AI security assessments, AI-SPM, or AI model risk evaluations
- AI/ML pipeline security, model security, and MLOps security practices
- AI governance, responsible AI policy development, and AI risk management frameworks
- DevSecOps and CI/CD security, including hands-on experience with platforms and harnesses
- Cloud security with specific experience securing AI workloads on platforms such as AWS, Azure, or GCP
- AI regulatory compliance and emerging AI-specific standards and guidance
- Cybersecurity architecture, risk management, and security controls design
- Familiarity with AI security frameworks and guidance, including NIST AI RMF, OWASP Top 10 for LLMs, and MITRE ATLAS
- Working knowledge of foundational cybersecurity frameworks—including NIST CSF, NIST 800-53, and ISO 27001/27002—as applied within AI-enabled environments
- Strong Microsoft PowerPoint, Excel, and Word skills
- Willingness to travel based on client and business needs; travel estimated at 25–50%
- with each bullet as a qualification. The inner list could be nested
- Professional certifications in cybersecurity (e.g., CISSP, CCSP, CISM) or emerging AI/ML security credentials.
- Hands-on experience with AI-SPM platforms, MLOps tooling, and AI security automation technologies.
- Experience with CI/CD orchestration and integrated security tooling, including harnesses, to enforce automated security gates within AI development pipelines.
- Knowledge of adversarial machine learning techniques, model explainability requirements, and AI supply chain risk management.
- Exposure to AI-related regulatory developments, including the EU AI Act, NIST AI RMF, and sector-specific AI guidance applicable to financial services, healthcare, or critical infrastructure.
- Experience facilitating client workshops, technical design sessions, and AI security architecture reviews.
- Background in software development, data engineering, or ML engineering that informs deep technical AI security expertise.
- Experience within a consulting, professional services, or advisory environment.
- New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $125,800 to $209,700
- Bay Area California offices – $131,100 to $218,500
- All other offices locations in the US, including Sacramento – $104,800 to $192,200
- Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography.
- . That's okay.
Preferred Qualifications
What We Look For
We are seeking professionals who are deeply curious about the intersection of artificial intelligence and cybersecurity, with the hands-on technical capabilities to assess and architect secure AI systems alongside the advisory acumen to guide organizational AI governance strategies. Successful candidates combine technical depth in AI security with strong business judgment and can engage confidently with both engineering teams and executive stakeholders. The ideal candidate is motivated by the challenge of securing transformative and rapidly evolving technologies, committed to delivering exceptional client outcomes, and eager to help shape and grow EY’s Cyber practice.
Pay
The salary range for this job is:
Benefits
In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
We should also include the "What We Offer You" intro: "At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers." That's substantive. Could be part of
- for any list of duties/requirements/benefits. The responsibilities are not explicitly a list but could be considered duties. We could format each sentence as a list item. However that might be too granular but still a list. The instruction says "any list of duties/requirements/benefits". The responsibilities section is a list of duties albeit in prose. Safer to treat as