AI Application Security Architect

AI Application Security Architect

Location:

New Jersey, US or London, UK.

We are seeking a highly skilled professional to drive the secure development lifecycle (SDLC) of agentic AI systems and applications across multi‑cloud (AWS, Azure, GCP) and hybrid/on‑prem environments. This role focuses on embedding robust application security controls, performing secure SDLC reviews, and leading the design and automation of security validation for agentic AI and LLM‑powered solutions.

• Integrate security best practices throughout the SDLC for agentic AI applications, from design and code to deployment and operations.
• Develop and maintain automated security testing pipelines (SAST, DAST, SCA) for AI agents, APIs, and orchestration layers.
• Conduct security code reviews and threat modeling for agentic AI, focusing on model inputs/outputs, agent‑to‑agent, agent‑to‑process, and multi‑agent control plane interactions, as well as plugin/tool integration.
• Implement and automate security controls for secure agent deployment (sandboxing, RBAC/ABAC, policy enforcement, prompt injection/jailbreak mitigations).
• Ensure traceability and compliance by mapping agentic AI controls to regulatory frameworks (e.g., SOC 2, ISO 27001, NIST 800‑53, GDPR/CCPA).
• Design, implement, and continuously improve security for agentic AI systems, including secure orchestration protocols such as A2A, A2P, MCP, and related communication patterns.
• Build and test secure‑by‑design agentic AI features, including runtime isolation, egress controls, audit trails, and observability (telemetry, prompt/result logging, risk scoring).
• Embed LLMOps/MLOps security into CI/CD (model artifact scanning, SBOMs, policy‑as‑code, attestation, controlled promotion).
• Continuously evaluate agent safety with adversarial prompts, scenario‑based testing, drift/hallucination detection, and bias/fairness assessments.
• Develop and execute comprehensive AI security and penetration testing strategies for agentic AI applications and systems.
• Lead offensive security assessments, including adversarial prompt testing, agent misuse scenarios, and vulnerability identification.
• Collaborate with engineering teams to remediate findings and strengthen security posture across AI‑enabled applications.
• Define and operationalize agentic AI security policies, standards, and playbooks for engineering teams.
• Lead secure SDLC and AI security enablement: deliver secure coding guidelines, threat modeling workshops, and prompt hygiene training.
• Communicate risk, security posture, and value trade‑offs to business stakeholders and executives.
• Present security metrics, dashboards, and reports on application/AI security KPIs, incidents, and risk reduction.
• Partner with Cloud, Data Science, and Platform teams to deliver secure agentic AI features while maintaining a strong security posture.

• 10+ years in Application Security or Security Engineering.
• 5+ years in secure SDLC roles.
• 1+ year in AI/ML or LLMOps security.
• Hands‑on multi‑cloud experience (AWS/Azure/GCP/OCI) with IAM, KMS, security monitoring, and AI services.
• Proficiency in secure SDLC automation tools (SAST, DAST, SCA, IaC scanning).
• Strong knowledge of agentic AI/LLM stacks (RAG, vector DBs, agent orchestration, prompt engineering, policy guardrails), with hands‑on experience in agentic protocols such as A2A, A2P, MCP.
• Experience with threat modeling, offensive testing, and application security for AI/ML systems.
• Understanding of privacy and compliance requirements for AI‑enabled applications.

• Experience deploying agentic AI or LLM‑based applications with secure tool chains and runtime isolation.
• Familiarity with confidential computing, privacy‑preserving ML, and explainable AI.
• Background in regulated industries (e.g., financial services, healthcare).
• Security and cloud certifications: CISSP, CCSP, CISM, OSCP, CKA, AWS/Azure/GCP security specialties.

Base salary range: $165,000 – $215,000 (US applicants only). Final compensation will be based on geographic location, experience, and qualifications. Eligible for an annual incentive plan (not a separate bonus or commission).

S&P Global is an equal opportunity employer and all qualified candidates will receive consideration for employment without regard to race/ethnicity, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, marital status, military veteran status, unemployment status, or any other status protected by law. Only electronic job submissions will be considered for employment.