AI Security Engineer
AlphaSense
IndiaremotePosted 10 days ago
Skill Required
AI-Security-EngineerSecurity-AnalystAI-Security-AnalystSOC-AnalystGRC-AnalystAI-Cybersecurity-EngineerAI-Security-EngineeringAI-Application-Security-EngineerSecurity-AI-EngineeringAI-Cybersecurity-EngineeringSecurity-EngineerAI EngineerSecurity EngineersecurityAISOCEngineeringautomationObservabilityLangChainsimilar)buildingwrittenTestNGPythonGitAzureOWASPOAuthCloudjQuerySIEMSQLAWSGCPandGenerative AIMachine LearningFulltime
Key highlights
- Experience: 3-5+ years in security analysis, SOC, or GRC analyst roles
- Notable Requirement: Applied experience in AI/LLM risk testing, CASB discovery, Non-human identity investigation, or Agentic AI architecture
Role overview
AlphaSense is building an AI Security and Governance capability and is seeking an AI Security Analyst to serve as the front line for detecting, investigating, and containing risk across every AI tool, agent, and model touching AlphaSense's environment. The role involves monitoring enterprise AI usage end to end, hunting for shadow AI and rogue agent activity, and contributing to the evidence base for ISO 42001 certification and the company's broader AI risk posture.
Responsibilities
- Continuously monitor CASB/SWG, OAuth, and endpoint telemetry to discover unsanctioned AI tools, browser extensions, and API-level agents in use across the business.
- Classify findings by risk tier and escalate unauthorized deployments for containment.
- Investigate alerts related to autonomous agents and AI-powered workflows (e.g., anomalous tool chains, unexpected data access, credential misuse) including threats such as OpenClaw and similar agent-based attack patterns.
- Document findings and drive remediation with the Automation Engineer and Identity teams.
- Monitor DLP and AI usage logs for signs of sensitive data leaving the environment through AI tools (prompts, uploads, plugins, MCP connectors).
- Tune detection rules and validate that AI-specific DLP controls are operating as designed.
- Monitor usage of developer-facing AI tools (GitHub Copilot, Claude Code, Codex, and similar) for policy compliance, credential exposure, and non-human identity risk.
- Partner with Engineering to ensure code-assist and agentic dev tools operate within approved guardrails.
- Maintain and validate AI activity logging and data retention controls to ensure auditability.
- Assemble and organize evidence supporting ISO 42001 audits, EU AI Act readiness, and internal AI impact assessments.
- Analyze false positive/negative trends across AI security detections and recommend threshold and logic adjustments.
- Feed recurring patterns into the Automation Engineer's playbook backlog.
- Partner with Security Operations, Identity, Legal, and AI/ML Engineering to align findings with existing incident response processes, and support the Director in preparing risk findings for governance council and executive reporting.
Requirements
- 3-5+ years in security analysis, SOC, or GRC analyst roles
- Working knowledge of SIEM platforms (Splunk, Microsoft Sentinel, Google Chronicle) and DLP/CASB tooling
- Understanding of AI/LLM risk concepts: prompt injection, data exfiltration via AI tools, model/agent misuse, shadow AI
- Familiarity with non-human identity concepts (service accounts, API keys, OAuth tokens) and their security challenges
- Understanding of threat detection logic
- Comfortable reading and interpreting logs, API telemetry, and structured/unstructured investigation data
- Basic scripting or query proficiency (Python, SQL, or SPL/KQL) for investigation and reporting
- Strong written documentation habits
- Ability to translate technical findings into clear, risk-based narratives
- Familiarity with cloud environments (AWS, Azure, or GCP)
- Must demonstrate genuine, applied experience in at least one of the following: Hands-on AI/LLM risk testing or investigation (prompt injection testing, model/agent misuse investigation, or AI-specific data exfiltration analysis); CASB/SWG-based application discovery (unsanctioned SaaS, browser extension, or shadow IT/shadow AI detection using tools such as Netskope, Zscaler, Microsoft Defender for Cloud Apps, Wiz, or similar); Non-human identity investigation (API key, OAuth token, or service account misuse investigation and risk assessment); Agentic AI or MCP-based architecture exposure (securing, testing, or building agent tool-use pipelines such as LangChain, AutoGen, CrewAI, MCP servers)
Nice to have
- MITRE ATT exposure to MITRE ATLAS or OWASP LLM Top 10
- Hands-on (not just conceptual) exposure to AI governance frameworks — ISO 42001, NIST AI RMF, EU AI Act risk tiers — ideally through audit evidence collection or control testing (SOC 2, ISO, or similar)
- Direct experience with any of: Netskope, Zscaler, Wiz, Orca Security, Microsoft Purview, Abnormal Security, Bolster AI, or comparable AI-aware security platforms
- Exposure to ML-based anomaly detection or NLP-driven log analysis
- Certifications: Security+, CISSP (Associate), or AI-specific credentials (e.g., AI/ML security, OWASP AI, GIAC)
Additional details
- The acquisition of Tegus by AlphaSense in 2024 advances our shared mission to empower professionals to make smarter decisions through AI-driven market intelligence.
- Our platform is trusted by over 6,000 enterprise customers, including a majority of the S&P 500.
- Founded in 2011, AlphaSense is headquartered in New York City with more than 2,000 employees across the globe and offices in the U.S., U.K., Finland, India, Singapore, Canada, and Ireland.
- AlphaSense is an equal-opportunity employer. We are committed to a work environment that supports, inspires, and respects all individuals.
- AlphaSense does not discriminate against any employee or applicant on the basis of race, color, sex (including pregnancy), national origin, age, religion, marital status, sexual orientation, gender identity, gender expression, military or veteran status, disability, or any other non-merit factor.
- AlphaSense provides reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations, and ordinances.
- Recruiting Scams and Fraud: AlphaSense never asks candidates to pay for job applications, equipment, or training; official communications come from an @ email address.
- Originally posted on Himalayas