GuidePoint Security - AI Security Engineer - North Central region

• AI Security Architecture & Assessment: Conduct secure configuration reviews and security assessments of enterprise AI platforms (e.g., Anthropic Claude Enterprise, OpenAI ChatGPT Enterprise, Microsoft Copilot) against established control domains — including identity and provisioning, network and access enforcement, data protection and retention, and audit and compliance — identifying vulnerabilities, attack surfaces, and gaps against industry frameworks (e.g., OWASP LLM Top 10, MITRE ATLAS) • AI Security Architecture & Assessment: • Threat Modeling for AI Systems: Lead threat modeling exercises specific to AI workloads, covering prompt injection, model inversion, data poisoning, supply chain risks, excessive agency, privilege escalation through tool chaining, and unauthorized cross-application data movement across SaaS, self-hosted, and local AI deployments • Threat Modeling for AI Systems: • AI Coding Tool & Development Environment Security: Assess AI coding tools and development environments — including Claude Code, OpenAI Codex, Open Code, Cursor, and MCP servers — for sandbox isolation, plugin allowlisting, secrets access, network egress controls, and CI/CD pipeline security • AI Coding Tool & Development Environment Security: • Secure AI Integration Guidance: Advise client teams on securely integrating SaaS AI services and APIs (e.g., OpenAI, Azure OpenAI, AWS Bedrock) into enterprise applications, including safe handling of credentials, outputs, and user data • Secure AI Integration Guidance: • Data Security & Privacy Controls: Evaluate and recommend controls for data ingestion pipelines, RAG architectures, and vector databases to prevent unauthorized data exposure, leakage through model outputs, or non-compliant data processing — including zero data retention enforcement, sensitivity labeling, data classification, and encryption key management • Data Security & Privacy Controls: • Shadow AI Discovery: Conduct shadow AI discovery engagements to inventory unsanctioned AI tool usage and assess associated data exposure risks across client environments • Shadow AI Discovery: • Security Controls & Guardrails Evaluation: Evaluate security controls and guardrails across AI platforms, including identity and access management, DLP integration, conditional access policies, SIEM and logging configurations, human-in-the-loop mechanisms, and AI-specific runtime protections • Security Controls & Guardrails Evaluation: • Agentic Workflow Development: Design, build, and deploy AI agent workflows including use-case design, agent architecture, and integration with security tooling and automation platforms • Agentic Workflow Development: • Security Architecture Reviews: Perform security architecture reviews for organizations deploying AI agents that connect to tools, data sources, or other agents via MCP or agentic frameworks, delivering reference architectures and recommendations • Security Architecture Reviews: • Security Documentation & Deliverables: Develop and deliver engagement artifacts including secure configuration review reports, prioritized findings registers, AI security control matrices, reference architectures, risk assessments, control frameworks, and secure enablement roadmaps • Security Documentation & Deliverables: • Strategic AI Security Roadmap: Contribute to the development of long-term AI security strategies for clients, including prioritized remediation roadmaps, capability maturity assessments, and investment recommendations • Strategic AI Security Roadmap: • Collaboration & Stakeholder Engagement: Serve as a trusted security advisor bridging business stakeholders, AI/ML engineers, IT operations, and information security teams — conducting stakeholder interviews and facilitating knowledge transfer sessions covering AI platform administration, troubleshooting, and operational runbooks • Collaboration & Stakeholder Engagement: • AI Threat Landscape Monitoring: Continuously track emerging AI security research, adversarial techniques, regulatory developments, and vendor security advisories (e.g., Anthropic, OpenAI, Microsoft feature releases) to keep client guidance relevant and proactive • AI Threat Landscape Monitoring: