Lead AI Security Engineer - Senior Manager
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections that have real specific content. The posting includes: "The opportunity" description (maybe About the role). Then "Your Key Responsibilities" (Responsibilities). Then "Skills And Attributes For Success" (Skills). Then "To qualify you must have ..." (Requirements/Qualifications). Then "What We Offer You" (Benefits). Also includes base salary range (Pay). No schedule info. So we should include sections: About the role (maybe from "The opportunity" paragraph). Responsibilities (Your Key Responsibilities). Skills (Skills And Attributes For Success). Requirements (To qualify you must have ...). Qualifications maybe same as Requirements? We could combine but they said prefer few substantive sections over many thin ones. Could have Requirements and Qualifications separate if content distinct. The qualifications list includes degree, years experience, etc. That's both requirements and qualifications. Could put under Requirements. Could also have Qualifications separate but content similar. Better to have one section: Requirements (or Qualifications). Since they ask to use headings exactly as given, we can include both if we have content. But we have only one block that covers both. Could split: Requirements (education, years) and Qualifications (specific skills). But the "Skills And Attributes For Success" already covers skills. So maybe Requirements: education and experience. Qualifications: maybe the list of specific technical requirements (depth in cloud-native, etc). However that list overlaps with skills. Might be better to have: Requirements (education + experience) and Qualifications (the detailed technical requirements). But we need to avoid filler. Let's extract.
About the role: The paragraph starting "Location: Anywhere in Country At EY, we’re all in..." up to "This role exists to make EY’s agentic platform defensible..." Actually the "The opportunity" section includes description. We'll take from "The opportunity We are seeking an AI Security Engineer..." to the end of that paragraph before "Your Key Responsibilities". That is substantive.
Responsibilities: list under "Your Key Responsibilities". Each bullet starts with a bold phrase? We'll convert to - .
Skills: "Skills And Attributes For Success" bullet list.
Requirements: "To qualify you must have Bachelor’s or Master’s degree..." plus maybe the list after that? Actually after that sentence continues with "10+ years in security engineering..." etc. That's all requirements.
Qualifications: maybe we could treat the same as Requirements; but to avoid duplication we could omit Qualifications section. However instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It's examples, not mandatory to include all. So we can include only those with content. We'll include About the role, Responsibilities, Skills, Requirements, Benefits, Pay. No Schedule.
Pay: base salary range details.
Benefits: "What We Offer You" paragraph about compensation and benefits, medical, dental, pension, 401(k), paid time off, flexible vacation policy, etc.
We must not include boilerplate like EEO, legal, etc. Remove navigation, cookie, etc. Also remove duplicated lines.
Now produce HTML fragment.
We need to wrap content in appropriate tags: About the role
then
...
. For lists: Responsibilities
- ...
. Ensure we preserve all substantive information, no invention.
Let's extract text.
About the role: From "The opportunity We are seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end." Continue until before "Your Key Responsibilities". Let's copy that paragraph:
"The opportunity We are seeking an AI Security Engineer to own the security posture of EY’s Agentic AI platform end to end. Agentic AI breaks the assumptions most enterprise security programs are built on. Systems now generate and execute their own code, invoke tools and external APIs autonomously, act on behalf of human principals across long delegation chains, and can be manipulated through the same channel that carries legitimate instructions. Perimeter controls, static code review, and human-in-the-loop approval do not contain any of this on their own. This role exists to make EY’s agentic platform defensible in the most highly regulated client environments in the world, including tax, financial services, audit, and risk. It is the security engineering and assurance authority spanning the whole stack: from silicon-level attestation and Kubernetes hardening, through supply-chain integrity and sandboxed execution, to prompt-injection defense, agent authority containment, and audit-grade evidence. This is a deliberately broad mandate. It is ideal for a principal security engineer who has genuine depth in cloud-native and platform security, who has moved decisively into AI and agentic threat models, and who is equally comfortable writing a threat model, breaking a system in a red-team exercise, defining policy-as-code, and defending the resulting engineering to a client’s CISO or a regulator."
We'll put that in .
Responsibilities: list items from "Your Key Responsibilities". Let's extract each bullet:
- Own the platform threat model: covering agent autonomy, tool invocation, delegated authority, model and data supply chain, multi-tenancy, and every deployment target from cloud to air-gapped, and keep it current as the platform evolves through each build phase.
- Define the security engineering and control set for every platform layer: infrastructure and boot chain, Kubernetes and cluster fabric, identity and secrets, secure execution and sandboxing, gateway and egress, data and state, delivery pipeline, and telemetry.
- Set the secure-by-default contract so that platform capabilities arrive hardened, including agent templates, Helm charts, sandbox profiles, and network policy ship with correct controls rather than requiring teams to add them.
- Own defense against agentic threat classes including direct and indirect prompt injection, jailbreak and instruction hijacking, excessive agency, confused-deputy and authority-escalation attacks, tool and function-call abuse, memory and context poisoning, and retrieval-augmented data exfiltration.
- Work with the architecture team to help define the agent authority model: delegated and on-behalf-of authority, scope and delegation-depth limits, consent boundaries, and the non-escalation invariant that an agent never exceeds the authority of its initiating principal at any hop.
- Own the sandboxing security standard for agent-generated code execution: isolation boundaries, filesystem and credential scope, egress restriction, resource containment, and the escape-test suite that proves the boundary holds.
- Secure the model and knowledge supply chain: model provenance and integrity, upstream registry governance, poisoning and backdoor risk, embedding and vector-store integrity.
- Secure agent-to-agent and tool protocols including MCP and A2A surfaces: discovery trust, tool registration and approval, schema validation, and authorization of inter-agent calls.
- Lead AI red teaming and adversarial testing: build the offensive capability and the recurring exercise cadence that tests guardrails, sandboxes, and authority boundaries before adversaries and auditors do.
- Own supply-chain integrity end to end: artifact signing and verification (Sigstore/Cosign, Notation), SBOM generation and attestation, provenance and SLSA-aligned build integrity, CVE management, dependency and license governance.
- Own admission and runtime policy: policy-as-code across Kyverno and OPA, signature-verification enforcement, Pod Security Standards, and the guardrails that make non-compliant workloads unschedulable rather than merely reported.
- Define Kubernetes and infrastructure hardening baselines: CIS-aligned cluster configuration, network default-deny and segmentation, node and boot-chain integrity, GPU and DPU isolation, and secrets-handling standards.
- Own tenant isolation assurance: the security definition of a tenant boundary across compute, network, storage, secrets, telemetry, and evidence, and the testing that proves cross-tenant leakage is not possible.
- Serve as the security authority in client engagements: lead security engineering reviews, respond to client CISO and regulator scrutiny, and produce the assurance artefacts that unblock deployment into regulated environments.
- Drive security detection and response for the platform: detection engineering for agentic misbehavior, security telemetry requirements, alerting, incident response playbooks, and post-incident review.
We'll put each as
- .
Skills: from "Skills And Attributes For Success". Bullets:
- Deep cloud-native security expertise: Kubernetes, container, and infrastructure security at production scale, with real operational experience rather than assessment-only exposure.
- Genuine command of AI and agentic threat models, with the judgement to distinguish novel risk from familiar risk wearing new vocabulary.
- Strong zero-trust and workload-identity foundations: SPIFFE/SPIRE, PKI and certificate lifecycle, secrets management, and delegated authorization patterns.
- Fluency in policy-as-code, with the instinct to encode controls as enforced policy rather than documented expectation.
- Software supply-chain security depth: signing, provenance, SBOM, and build integrity.
- Offensive-security instinct: able to think like an attacker against systems that generate their own code and act autonomously.
- Pragmatism about risk: able to distinguish controls that must exist before the first client workload from those that can follow, and to defend both decisions.
- Exceptional communication: able to move between a deep technical design review, an executive risk conversation, and a regulator or client CISO discussion without losing precision.
- Security-as-enablement mindset: measured by how much safe delivery velocity the controls unlock, not by how much they prevent.
We'll list.
Requirements: from "To qualify you must have Bachelor’s or Master’s degree in Computer Science, Security, or a related technical field, or demonstrably equivalent depth.10+ years in security engineering, security engineering, or offensive security, including hands-on production ownership.Demonstrable depth in cloud-native and Kubernetes security: admission control, network policy, workload isolation, and runtime security in production.Hands-on experience with workload identity and secrets management (SPIFFE/SPIRE, Vault/OpenBao or equivalents) and with PKI and certificate lifecycle.Practical experience securing AI or ML systems in production, including familiarity with LLM and agentic attack surfaces, such as prompt injection, tool abuse, excessive agency, and model or data supply-chain risk.Threat modelling capability applied to real systems, with evidence that the resulting controls were built and verified.A track record delivering under compliance, security, or regulatory constraint with audit-grade evidence requirements.Experience defining ownership boundaries and control contracts with platform, data, runtime, and delivery teams."
We need to split into sentences for readability. We'll make a
with those sentences.
Benefits: from "What We Offer You At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is: ..." Wait that includes Pay. Actually Benefits section should be before Pay? We'll separate: Benefits: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options, flexible vacation policy, designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, other leaves of absence. Also mention professional growth etc. We'll extract.
Pay: base salary range details: "The base salary range for this job is: New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $150,700 to $251,200Bay Area California offices – $157,100 to $261,600All other offices locations in the US, including Sacramento – $125,500 to $230,200Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography."
We need to format nicely. We'll put in
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It's examples, not mandatory to include all. So we can include only those with content. We'll include About the role, Responsibilities, Skills, Requirements, Benefits, Pay. No Schedule.
Pay: base salary range details.
Benefits: "What We Offer You" paragraph about compensation and benefits, medical, dental, pension, 401(k), paid time off, flexible vacation policy, etc.
We must not include boilerplate like EEO, legal, etc. Remove navigation, cookie, etc. Also remove duplicated lines.
Now produce HTML fragment.
We need to wrap content in appropriate tags: About the role
then
...
. For lists:Responsibilities
- ...
. Responsibilities: list items from "Your Key Responsibilities". Let's extract each bullet: - Own the platform threat model: covering agent autonomy, tool invocation, delegated authority, model and data supply chain, multi-tenancy, and every deployment target from cloud to air-gapped, and keep it current as the platform evolves through each build phase. - Define the security engineering and control set for every platform layer: infrastructure and boot chain, Kubernetes and cluster fabric, identity and secrets, secure execution and sandboxing, gateway and egress, data and state, delivery pipeline, and telemetry. - Set the secure-by-default contract so that platform capabilities arrive hardened, including agent templates, Helm charts, sandbox profiles, and network policy ship with correct controls rather than requiring teams to add them. - Own defense against agentic threat classes including direct and indirect prompt injection, jailbreak and instruction hijacking, excessive agency, confused-deputy and authority-escalation attacks, tool and function-call abuse, memory and context poisoning, and retrieval-augmented data exfiltration. - Work with the architecture team to help define the agent authority model: delegated and on-behalf-of authority, scope and delegation-depth limits, consent boundaries, and the non-escalation invariant that an agent never exceeds the authority of its initiating principal at any hop. - Own the sandboxing security standard for agent-generated code execution: isolation boundaries, filesystem and credential scope, egress restriction, resource containment, and the escape-test suite that proves the boundary holds. - Secure the model and knowledge supply chain: model provenance and integrity, upstream registry governance, poisoning and backdoor risk, embedding and vector-store integrity. - Secure agent-to-agent and tool protocols including MCP and A2A surfaces: discovery trust, tool registration and approval, schema validation, and authorization of inter-agent calls. - Lead AI red teaming and adversarial testing: build the offensive capability and the recurring exercise cadence that tests guardrails, sandboxes, and authority boundaries before adversaries and auditors do. - Own supply-chain integrity end to end: artifact signing and verification (Sigstore/Cosign, Notation), SBOM generation and attestation, provenance and SLSA-aligned build integrity, CVE management, dependency and license governance. - Own admission and runtime policy: policy-as-code across Kyverno and OPA, signature-verification enforcement, Pod Security Standards, and the guardrails that make non-compliant workloads unschedulable rather than merely reported. - Define Kubernetes and infrastructure hardening baselines: CIS-aligned cluster configuration, network default-deny and segmentation, node and boot-chain integrity, GPU and DPU isolation, and secrets-handling standards. - Own tenant isolation assurance: the security definition of a tenant boundary across compute, network, storage, secrets, telemetry, and evidence, and the testing that proves cross-tenant leakage is not possible. - Serve as the security authority in client engagements: lead security engineering reviews, respond to client CISO and regulator scrutiny, and produce the assurance artefacts that unblock deployment into regulated environments. - Drive security detection and response for the platform: detection engineering for agentic misbehavior, security telemetry requirements, alerting, incident response playbooks, and post-incident review. We'll put each as
with those sentences.
Benefits: from "What We Offer You At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is: ..." Wait that includes Pay. Actually Benefits section should be before Pay? We'll separate: Benefits: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options, flexible vacation policy, designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, other leaves of absence. Also mention professional growth etc. We'll extract.
Pay: base salary range details: "The base salary range for this job is: New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $150,700 to $251,200Bay Area California offices – $157,100 to $261,600All other offices locations in the US, including Sacramento – $125,500 to $230,200Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography."
We need to format nicely. We'll put in