Senior AI Security Engineer

Role Snapshot

Pay $130,000–$150,000 annual base, based on relevant experience and demonstrated capability. Location/Schedule US-based, remote or hybrid, full-time.

Purpose: Own day-to-day enterprise security, lead technical incident response, and help Mercola use and secure AI across the business.

Key Responsibilities

• Own the incident queue, risk register, and remediation backlog. Assign owners and deadlines, maintain policies and runbooks, and report progress and unresolved risks to leadership.
• Lead technical incident response from triage through recovery validation. Coordinate containment, preserve evidence, and involve Legal or specialist responders as needed.
• Strengthen identity, access, and infrastructure controls across Microsoft 365, Entra ID, AWS, and connected applications.
• Partner with Infrastructure to verify improvements across endpoints, servers, networks, and cloud platforms.
• Validate logging coverage, retention, alert delivery, and after-hours escalation with internal owners and managed security providers.
• Use AI assistants for investigation, code review, threat analysis, and automation. Independently validate findings and proposed fixes before acting on them.
• Secure AI applications, agents, and Model Context Protocol (MCP) integrations against prompt injection, excessive permissions, data exposure, and unsafe tool actions.
• Partner with Engineering on application, API, and mobile security.
• Integrate code, dependency, and secret scanning into development workflows, prioritize exploitable findings, coordinate authorized testing, and verify remediation.
• Build security automation with Python, PowerShell, APIs, or comparable tools. Document ownership, failure alerts, audit trails, and rollback procedures.
• Assess vendor security, data flows, and third-party access.
• Maintain security evidence for applicable contractual, privacy, and compliance needs, and coordinate security awareness and specialist support.

Must-Have Qualifications

• Hands-on experience in security engineering, incident response, or security operations, with examples of taking issues through investigation, remediation, and verification.
• Practical experience securing hybrid environments across Microsoft 365 and Entra ID, cloud services such as AWS, endpoints, and networks.
• Ability to interpret logs and assess access, application permissions, and potential data exposure.
• Experience using AI assistants in engineering or security work.
• Ability to explain how you limit permissions, protect sensitive information, and validate AI-generated output.
• Ability to write scripts, work with APIs, and review application code or configurations for security issues.
• Familiarity with Git and CI/CD workflows.
• Ability to prioritize competing security work, coordinate technical owners and providers, and communicate risks and decisions clearly to leadership.
• Sound judgment about evidence preservation, testing authorization, production changes, and when to involve specialists.

Preferred Qualifications

• Experience with Microsoft Defender or comparable endpoint protection, security information and event management (SIEM), or managed detection services.
• Experience with Azure DevOps, application or API security testing, cloud or container security, or governance of AI coding tools and MCP integrations.
• Relevant certifications or a degree are welcome. Mercola values demonstrated capability and equivalent experience equally.