Sr. AI Security Engineer

McCarthy Holdings, Inc. (McCarthy), is the holding entity for McCarthy Building Companies, Inc., the oldest privately-held national construction company in America, and Castle Contracting. McCarthy provides the crucial business infrastructure for these entities and connects the day-to-day operations to ensure seamless operations across the business. Repeatedly honored as a great place to work and healthiest employer, McCarthy is a 100 percent employee-owned company. At McCarthy, we are committed to sustaining a culture that delivers great experiences for everyone. This begins with developing high-performing individuals and teams through our award-winning learning and development programs, best-in-class Total Rewards benefits, and our inclusive culture aligned with our core values: Genuine. We, Not I. All In. How do McCarthy partners define our culture? We Live Our Core Values: We do whatever it takes to deliver on our promises with honesty and integrity. We are Employee Owned: We are personally invested in building the things people need in our communities. We Feel Like a Family: We value genuine connections and help each other succeed in an inclusive environment. We are Builders: We respect the work we do and everyone who helps make it happen safely.

Position Summary

The Sr. AI Security Engineer will help secure the design, deployment, and operation of AI-enabled products and services. This role will help protect data, systems, users, and customers as generative AI, machine learning, and agentic technologies continue to evolve. As a member of the Cybersecurity team, the engineer will work closely with AI, engineering, architecture, legal, and compliance teams. The organization has existing AI tools and controls in place, and this role will assess their effectiveness, recommend additional capabilities where needed, and mature the overall AI security toolset over time. Rather than building an AI-security stack from scratch, the engineer will configure, tune, validate, operate, and extend existing security solutions while helping teams apply practical secure-by-design practices. The ideal candidate combines hands-on security architecture or engineering experience, production AI-security experience, and the ability to explain complex risks clearly to both technical and non-technical audiences.

Responsibilities

• Develop and maintain enterprise AI security standards, control requirements, and risk-based review processes.
• Assess AI applications, models, agents, APIs, integrations, vendors, and data flows before and after deployment.
• Define security requirements for AI systems across design, development, testing, deployment, operation, and retirement.
• Evaluate identity, access, identity governance, data protection, privacy, logging, monitoring, retention, and human-oversight controls.
• Test AI systems and agent workflows for prompt injection, indirect injection, jailbreaks, data leakage, excessive agency, unsafe tool use, insecure integrations, and configuration drift.
• Conduct threat modeling, architecture reviews, security assessments, and control validation for AI-enabled solutions.
• Establish processes for AI security findings, incident response, exception management, remediation, and executive reporting.
• Review AI vendors, models, third parties, subprocessors, data handling practices, and material platform or configuration changes.
• Configure, tune, validate, operate, and extend existing AI-security, AI-governance, application-security, data-security, and monitoring tools.
• Support the evaluation and integration of additional capabilities where existing controls require enhancement.
• Create practical security patterns, reference architectures, playbooks, standards, and guidance for engineering and product teams.
• Monitor emerging AI threats, vulnerabilities, standards, regulations, and industry practices and translate them into actionable improvements.
• Partner with development and platform teams to integrate security controls into AI development and deployment workflows.
• Communicate technical risks, business impact, and recommended actions to both technical and non-technical stakeholders.
• Promote responsible AI adoption through measurable controls, clear accountability, and continuous improvement.