Senior Security Engineer

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes description of role, responsibilities (What Will You Do), requirements (What You Will Have), preferred qualifications, benefits (About Us -> What We Give You In Return). No explicit Pay or Schedule. So we should not include Pay or Schedule sections. Also maybe Skills? The posting includes some skill-like items but they are part of requirements/qualifications. Could combine into Requirements and Qualifications sections. The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We need to decide which sections to include based on content. We have: - About the role: could be the introductory paragraph describing the role. That's present: "Job Description At Cetera, our Information Security organization protects..." That's about the role. So we can have

About the role

with a paragraph. - Responsibilities: "What Will You Do" list. So include

Responsibilities

with

• items. - Requirements: "What You Will Have" (mandatory qualifications). So include

  Requirements

  with list. - Qualifications: "Preferred Qualifications". So include

  Qualifications

  with list. - Skills: Could be derived but we already have requirements and qualifications; maybe we can omit Skills to avoid thin sections. The instruction: Prefer a few substantive sections over many thin ones. So we can skip Skills. - Benefits: "What We Give You In Return" includes benefits. So include

  Benefits

  with list. - Pay and Schedule: not present, so omit. We must preserve all substantive information, not invent or summarize away detail. Need to keep all details from the posting, but we can format as lists. We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. At the end there is EEO statement, etc. We need to drop that. Also drop "About Cetera" description? That is substantive about company but maybe not required? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. The "About Cetera" section is substantive about the company. Should we include it? It could be part of "About the role" or separate? The instruction says use headings for sections like About the role, Responsibilities, etc. The "About Cetera" is not exactly about the role but about the company. Could be considered part of "About the role" or we could add a separate section like "About Cetera". But the allowed headings list does not include "About Cetera". However we could incorporate that info into About the role paragraph. The instruction: "use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." The e.g. suggests those are examples, not exclusive list? It says use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Likely they expect only those headings. So we should not add other headings. So we incorporate Cetera description into About the role. We need to remove duplicated lines: there is duplicate "Additional benefits such as an Employee Assistance Program (EAP), identity theft protection (LifeLock), pet insurance, and other voluntary benefits to provide extra peace of mind" appears twice? Actually appears once in benefits list and again later? Let's check: In benefits paragraph: after listing many benefits, they say "Additional benefits such as an Employee Assistance Program (EAP), identity theft protection (LifeLock), pet insurance, and other voluntary benefits to provide extra peace of mind". Then later they repeat "Additional benefits such as an Employee Assistance Program (EAP), identity theft protection (LifeLock), pet insurance, and other voluntary benefits to provide extra peace of mind". Yes duplicate. We should include only once. Also need to remove EEO statement at end. Now craft HTML. Structure:

  About the role

  ... combine introductory paragraph and Cetera description ...

  Responsibilities

  • ... each bullet from "What Will You Do" ...

  Requirements

  • ... each bullet from "What You Will Have" (mandatory) ...

  Qualifications

  • ... each bullet from "Preferred Qualifications" ...

  Benefits

  • ... each benefit item from "What We Give You In Return" ...
  We need to ensure we preserve all substantive information. Let's extract. Intro paragraph: "Job Description At Cetera, our Information Security organization protects employees, advisors, and clients from evolving cyber threats across cloud, SaaS, and emerging AI-enabled technologies. As artificial intelligence capabilities expand across the enterprise, Cetera is building a formal AI risk and compliance program — grounded in industry-recognized AI risk management frameworks — to ensure innovation aligns with regulatory, security, and third-party risk expectations. We are seeking an AI Risk and Compliance Engineer to operationalize AI governance controls, manage AI-related third-party and vendor risk, and lead adversarial threat modeling for AI/ML systems using the MITRE ATLAS framework. This role serves as a key bridge across IT Risk, Cloud Security, Legal/Procurement, and AI/ML Engineering teams, translating AI risk management framework requirements into practical, auditable processes within a regulated financial services environment." We also have Cetera description later: "About Cetera Cetera Financial Group ® (Cetera) is a leading network of independent retail broker-dealers and registered investment advisers empowering the delivery of objective financial advice to individuals, families, and company retirement plans across the country through trusted financial advisors and financial institutions. Cetera is one of the largest independent financial advisor networks in the nation and a leading provider of retail services to the investment programs of banks and credit unions. Advisor support resources offered through Cetera include award-winning wealth management and advisory platforms, comprehensive broker-dealer and registered investment adviser services, practice management support, and innovative technology. Cetera Financial Group (Cetera) is a network of independent retail firms, including those that are members of FINRA/SIPC: Cetera Advisors LLC; Cetera Wealth Services, LLC (formerly known as Cetera Advisor Networks); Cetera Investment Services LLC (marketed as Cetera Financial Institutions or Cetera Investors); and Cetera Financial Specialists LLC. Entities registered as investment advisers with the Securities and Exchange Commission include Cetera Investment Management LLC and Cetera Investment Advisers LLC. Cetera's principal office is located at 655 W. Broadway, 11th Floor, San Diego, CA 92101. Avantax Planning Partners, Inc. is an SEC registered investment adviser within the Aretec Group, Inc. (dba Cetera Holdings, an affiliate of Cetera). All the referenced entities are under common ownership." We can combine both into About the role paragraph, maybe two paragraphs. Now Responsibilities bullets from "What Will You Do": - Operationalize AI governance controls: Implement and maintain controls aligned to recognized AI risk management frameworks (spanning governance, mapping, measurement, and management of AI risk), including control documentation, risk-control matrices (RCM), and evidence collection to support audits and regulatory exams. - Lead AI third-party risk management: Evaluate and onboard third-party AI/ML tools and vendors against security, privacy, and compliance criteria; document AI-specific vendor and contract requirements, SLAs, and fourth-party disclosures; support due diligence for AI vendors and data provenance reviews. - Maintain AI/vendor risk inventories: Build and maintain documentation of third-party AI components (models, datasets, APIs, pre-trained/foundation models) covering provenance, functionality, and known limitations, and map internal controls to those components. - Run ongoing AI risk assessments: Conduct recurring vendor risk and compliance assessments covering AI system performance, data quality, algorithmic bias, and security controls; monitor pre-trained/foundation model drift and SLA adherence; assess concentration and dependency risk across AI vendors. - Perform AI threat modeling: Design and execute threat models for AI/ML systems using the MITRE ATLAS framework to identify adversarial tactics and techniques — including prompt injection, data/model poisoning, model evasion, model extraction, and supply-chain risk in ML pipelines — across the AI development and deployment lifecycle. - Coordinate adversarial testing: Plan and coordinate red-teaming, adversarial testing, and penetration testing of AI/ML systems, and drive ongoing threat assessments informed by current threat intelligence and prior incidents. - Integrate AI into vulnerability management: Ensure AI-specific vulnerabilities and security findings are captured, prioritized, and remediated through existing enterprise vulnerability management processes. - Identify and assess unsanctioned AI usage: Support discovery and risk assessment of unsanctioned (shadow) AI tool usage across the enterprise and recommend remediation or approval pathways. - Partner cross-functionally: Work closely with IT Risk, Cloud Security, Legal, Procurement, and Application/AI Engineering teams to embed AI risk and compliance requirements into intake, procurement, and development processes. - Support governance and audit activities: Develop and maintain AI risk standards, control narratives, and runbooks; support internal and external audits and regulatory compliance activities (e.g., FINRA) by producing control evidence tied to the organization's AI risk management framework. Now Requirements bullets from "What You Will Have": - 8-10+ years of experience in IT/cyber risk, GRC, security engineering, or a related discipline, with direct exposure to AI/ML systems - Working knowledge of AI risk and control frameworks (e.g., NIST AI RMF or similar industry AI risk management frameworks) and OWASP Top 10 for LLMs - Practical experience with, or strong working knowledge of, threat modeling methodologies for AI/ML systems, including familiarity with MITRE ATT&CK and MITRE ATLAS - Experience building or operating third-party/vendor risk management processes — due diligence, contracting/SLAs, ongoing monitoring, and issue remediation - Understanding of AI-specific attack techniques (prompt injection, data/model poisoning, model evasion, model extraction/inversion) and associated mitigations - Ability to translate technical risk findings into control objectives, policy language, and audit-ready documentation - Experience in regulated environments (financial services or FINRA preferred) - Strong communication skills across technical, risk, legal, and compliance stakeholders Now Qualifications bullets from "Preferred Qualifications": - Experience with GRC platforms (e.g., Archer, ServiceNow GRC) for control and risk-register management - Certifications such as CRISC, CISSP, CCSP, or IAPP AIGP (AI Governance Professional) - Experience with AWS Bedrock or other cloud AI/ML platforms and cloud-native AI security - Familiarity with model cards, data lineage/provenance tooling, and AI bill-of-materials (AI-BOM) concepts - Prior participation in red team, purple team, or adversarial testing exercises involving ML systems - Exposure to AI governance committees or model risk management (MRM) functions Now Benefits list from "What We Give You In Return": We need to parse the benefits paragraph: "Inclusive health, dental, vision, and life insurance plans built to support diverse lifestyles, offer preventative care, and protect against hardship. Easy access to mental health benefits to meet our team members and their families where they are. 20+ days of paid time off (PTO), paid holidays, and 2 paid wellness days to give our employees the time they need to stay close with their loved ones, recharge, and give back to their communities. 401(k) savings plan with a generous company contribution (up to 5%), and access to a financial professional to offer our employees the opportunity to plan-ahead for a strong financial future well