Staff Security Engineer (A.I)
Posted Updated
Description
- Compass is embedding generative and agentic AI directly into the products our agents and clients use every day. This role owns the security of that surface
- You will be the technical authority on how Compass builds AI features safely, from the model and retrieval layer, through agent tool invocation, to what ultimately reaches a client’s screen. You will work shoulder-to-shoulder with the teams building the AI platform so that platform standards and security standards are one bar, not two
- Own the AI product security roadmap. Define the multi-year vision, strategy, and standards for securing AI capabilities in the Compass platform, developed jointly with the AI platform and product engineering teams
- Threat model AI capability builds. Drive architectural reviews and threat modeling for new AI features, RAG pipelines, multi-agent workflows, and automated decisioning before they ship
- Build production guardrails. Architect, deploy, and automate real-time protections for LLM inputs and outputs, including injection mitigation, jailbreak defense, output verification, and sensitive-data egress checks on generated responses
- Constrain autonomy. Design blast-radius controls for autonomous agents: scoped permissions, human-in-the-loop checkpoints for consequential actions, action audit trails, and safe tool-invocation patterns
- Secure the retrieval layer. Enforce data access controls, source integrity, tenancy boundaries, and retrieval-boundary protections across RAG and vector store implementations
- Harden the AI supply chain. Assess the security posture, privacy controls, data retention, and training-use terms of third-party foundation models, inference providers, and vector stores used in production
- Instrument and detect. Build detections and telemetry for AI-specific abuse in production, anomalous tool invocation, prompt abuse patterns, unusual retrieval behavior, and data exfiltration through model responses and integrate them into our monitoring estate
- Automate the standard. Ship reusable libraries, CI/CD checks, and evaluation harnesses so secure AI patterns are the default path for product engineers rather than a review gate
- Advise and evangelize. Act as the primary technical consultant for AI architecture decisions and translate emerging AI risk into concrete engineering roadmaps for both engineers and executives
- You communicate well across audiences, translating emerging AI risk into technical roadmaps for engineers and business impact for leadership
- You are proactive about finding and closing gaps in AI/ML workflows through tooling rather than policy
- Automation is your default approach to security, especially when securing complex AI systems at scale
- You have a deep working understanding of transformer architectures, inference pipelines, RAG, prompt engineering, and the OWASP Top 10 for LLMs
- You write production code, strong proficiency in Python or Go, with experience building real integrations and security pipelines, not just prototypes
- Demonstrated experience securing a production AI or ML system end to end, development lifecycle, deployment, and runtime
- Strong strategic communication skills with a proven ability to translate complex technical AI risk into business impact for executive leadership
- Experience threat modeling complex distributed systems and driving remediation with engineering teams
- Strong application and cloud security fundamentals: AWS and/or GCP, Kubernetes, IAM, API security, and DevSecOps practices
- 7+ years in security engineering, with 2+ years focused on AI/ML or LLM application security
- Expertise in adversarial ML and LLM risks including prompt injection, model poisoning, data extraction, and unsafe tool use, with hands-on red teaming experience
- Experience with multi-agent autonomous systems or Model Context Protocol (MCP) based architectures
- Familiarity with MITRE ATLAS, NIST AI RMF, or comparable AI threat/risk frameworks
- Background building evaluation and safety-testing harnesses for LLM applications
- Experience in a regulated or consumer-data-heavy environment where model outputs touch customer-facing decisions
- Prior work on AI platform security architecture or secure-by-default AI SDKs