Lead AI Security Engineer - Senior Manager

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. We must not repeat job title. Remove boilerplate, navigation, legal, EEO, etc. Preserve all substantive info. We need to parse the posting. Key sections: - About the role: The paragraph after "Location: Anywhere in Country At EY, we’re all in to shape your future with confidence..." That's about the role? Actually "The opportunity" then description. Could treat as About the role. - Responsibilities: List under "Your Key Responsibilities". Many bullet points. - Requirements: maybe "To qualify you must have Bachelor’s or Master’s degree..." plus other bullet points? Actually after "Skills And Attributes For Success" there is a list of skills. Then "To qualify you must have ..." That's qualifications. - Qualifications: maybe the bullet list after "To qualify you must have ..." includes education, years, etc. - Skills: The "Skills And Attributes For Success" list. - Benefits: The "What We Offer You" paragraph includes benefits: professional growth, personal fulfillment, inclusive culture, comprehensive compensation and benefits package, base salary range (but that's Pay), medical and dental coverage, pension and 401(k) plans, wide range of paid time off options, flexible vacation policy, time off for holidays, etc. So Benefits section should include those. - Pay: The base salary ranges listed. - Schedule: Not mentioned. No schedule info. So we should not include Schedule section. We must not include sections with placeholder or generic like "commensurate with experience". Not present. We must not include duplicated lines. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to strip out things like "Are you ready to shape your future with confidence? Apply today..." and "To make the most of your application experience..." and "EY accepts applications..." and "For those living in California..." and the values statements etc. Also remove the final EEO paragraph. We need to preserve all substantive information: responsibilities, skills, qualifications, benefits, pay. Let's extract. About the role: The paragraph starting "Location: Anywhere in Country At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. The opportunity We are seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end." Might be considered About the role. We'll include that as a

. Responsibilities: The bullet list under "Your Key Responsibilities". We'll capture each bullet as

. Need to preserve all content. Let's copy the responsibilities text exactly as given (but maybe trim trailing spaces). The list: - Own the platform threat model: covering agent autonomy, tool invocation, delegated authority, model and data supply chain, multi-tenancy, and every deployment target from cloud to air-gapped, and keep it current as the platform evolves through each build phase. - Define the security engineering and control set for every platform layer: infrastructure and boot chain, Kubernetes and cluster fabric, identity and secrets, secure execution and sandboxing, gateway and egress, data and state, delivery pipeline, and telemetry. - Set the secure-by-default contract so that platform capabilities arrive hardened, including agent templates, Helm charts, sandbox profiles, and network policy ship with correct controls rather than requiring teams to add them. - Own defense against agentic threat classes including direct and indirect prompt injection, jailbreak and instruction hijacking, excessive agency, confused-deputy and authority-escalation attacks, tool and function-call abuse, memory and context poisoning, and retrieval-augmented data exfiltration. - Work with the architecture team to help define the agent authority model: delegated and on-behalf-of authority, scope and delegation-depth limits, consent boundaries, and the non-escalation invariant that an agent never exceeds the authority of its initiating principal at any hop. - Own the sandboxing security standard for agent-generated code execution: isolation boundaries, filesystem and credential scope, egress restriction, resource containment, and the escape-test suite that proves the boundary holds. - Secure the model and knowledge supply chain: model provenance and integrity, upstream registry governance, poisoning and backdoor risk, embedding and vector-store integrity. - Secure agent-to-agent and tool protocols including MCP and A2A surfaces: discovery trust, tool registration and approval, schema validation, and authorization of inter-agent calls. - Lead AI red teaming and adversarial testing: build the offensive capability and the recurring exercise cadence that tests guardrails, sandboxes, and authority boundaries before adversaries and auditors do. - Own supply-chain integrity end to end: artifact signing and verification (Sigstore/Cosign, Notation), SBOM generation and attestation, provenance and SLSA-aligned build integrity, CVE management, dependency and license governance. - Own admission and runtime policy: policy-as-code across Kyverno and OPA, signature-verification enforcement, Pod Security Standards, and the guardrails that make non-compliant workloads unschedulable rather than merely reported. - Define Kubernetes and infrastructure hardening baselines: CIS-aligned cluster configuration, network default-deny and segmentation, node and boot-chain integrity, GPU and DPU isolation, and secrets-handling standards. - Own tenant isolation assurance: the security definition of a tenant boundary across compute, network, storage, secrets, telemetry, and evidence, and the testing that proves cross-tenant leakage is not possible. - Serve as the security authority in client engagements: lead security engineering reviews, respond to client CISO and regulator scrutiny, and produce the assurance artefacts that unblock deployment into regulated environments. - Drive security detection and response for the platform: detection engineering for agentic misbehavior, security telemetry requirements, alerting, incident response playbooks, and post-incident review. We'll put these in

• . Requirements: Might be the "To qualify you must have Bachelor’s or Master’s degree in Computer Science, Security, or a related technical field, or demonstrably equivalent depth.10+ years in security engineering, security engineering, or offensive security, including hands-on production ownership." Actually there is a duplicate "security engineering". We'll keep as is. But also there are many qualification bullet points after that? Actually after "Skills And Attributes For Success" there is a list of skills, then "To qualify you must have ..." then a long list of qualifications (many bullet-like sentences). Let's extract that. The text after "Skills And Attributes For Success" ends with a paragraph about "Security-as-enablement mindset". Then: "To qualify you must have Bachelor’s or Master’s degree in Computer Science, Security, or a related technical field, or demonstrably equivalent depth.10+ years in security engineering, security engineering, or offensive security, including hands-on production ownership.Demonstrable depth in cloud-native and Kubernetes security: admission control, network policy, workload isolation, and runtime security in production.Hands-on experience with workload identity and secrets management (SPIFFE/SPIRE, Vault/OpenBao or equivalents) and with PKI and certificate lifecycle.Practical experience securing AI or ML systems in production, including familiarity with LLM and agentic attack surfaces, such as prompt injection, tool abuse, excessive agency, and model or data supply-chain risk.Threat modelling capability applied to real systems, with evidence that the resulting controls were built and verified.A track record delivering under compliance, security, or regulatory constraint with audit-grade evidence requirements.Experience defining ownership boundaries and control contracts with platform, data, runtime, and delivery teams. Ideally, you'll also have Software supply-chain security experience: artifact signing, SBOM, provenance, and vulnerability management embedded in delivery pipelines.Policy-as-code experience with OPA, Kyverno, or equivalent admission and authorisation engines.Experience building or leading an AI red team, or running adversarial testing against LLM and agentic systems.Familiarity with confidential computing and hardware attestation (Intel TDX, AMD SEV-SNP, SGX, NVIDIA CC) and secure boot / measured boot designs.Working knowledge of the OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, and the EU AI Act as applied to real engineering.Experience with LLM guardrail and defense tooling (NeMo Guardrails, LLM Guard, LlamaFirewall, Guardrails AI, or equivalents) in production paths.Experience securing multi-tenant platforms across cloud, on-prem, edge, client-managed, and air-gapped deployment modes.Detection engineering and incident response experience, particularly for novel or behavioral threat classes.Client-facing or consulting background, with credibility in front of CISOs, auditors, and regulators.Relevant certifications (CISSP, OSCP, GIAC, cloud security specialties) or demonstrable equivalent depth.Exposure to regulated industries: financial services, tax, audit, healthcare, or public sector.Contribution to open-source security tooling, research, or public standards work in AI security." We need to split into sensible items. Could treat as a list of qualifications. We'll output
  • for each sentence separated by periods. But need to preserve all info; we can keep as a single paragraph? The instruction: Use
    • for any list of duties/requirements/benefits. So for qualifications we should list each item. We'll split by periods where each starts with a capital letter after a period. However some sentences have internal periods like "e.g." but not many. We'll approximate. Better to keep as a single

      for qualifications? But instruction says use

      • for any list of duties/requirements/benefits. Qualifications is a list of requirements, so we should use list. We'll create items: - Bachelor’s or Master’s degree in Computer Science, Security, or a related technical field, or demonstrably equivalent depth. - 10+ years in security engineering, security engineering, or offensive security, including hands-on production ownership. - Demonstrable depth in cloud-native and Kubernetes security: admission control, network policy, workload isolation, and runtime security in production. - Hands-on experience with workload identity and secrets management (SPIFFE/SPIRE, Vault/OpenBao or equivalents) and with PKI and certificate lifecycle. - Practical experience securing AI or ML systems in production, including familiarity with LLM and agentic attack surfaces, such as prompt injection, tool abuse, excessive agency, and model or data supply-chain risk. - Threat modelling capability applied to real systems, with evidence that the resulting controls were built and verified. - A track record delivering under compliance, security, or regulatory constraint with audit-grade evidence requirements. - Experience defining ownership boundaries and control contracts with platform, data, runtime, and delivery teams. - Ideally, you'll also have Software supply-chain security experience: artifact signing, SBOM, provenance, and vulnerability management embedded in delivery pipelines. - Policy-as-code experience with OPA, Kyverno, or equivalent admission and authorisation engines. - Experience building or leading an AI red team, or running adversarial testing against LLM and agentic systems. - Familiarity with confidential computing and hardware attestation (Intel TDX, AMD SEV-SNP, SGX, NVIDIA CC) and secure boot / measured boot designs. - Working knowledge of the OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, and the EU AI Act as applied to real engineering. - Experience with LLM guardrail and defense tooling (NeMo Guardrails, LLM Guard, LlamaFirewall, Guardrails AI, or equivalents) in production paths. - Experience securing multi-tenant platforms across cloud, on-prem, edge, client-managed, and air-gapped deployment modes. - Detection engineering and incident response experience, particularly for novel or behavioral threat classes. - Client-facing or consulting background, with credibility in front of CISOs, auditors, and regulators. - Relevant certifications (CISSP, OSCP, GIAC, cloud security specialties)