Main tasks and responsibilities

• Drive Corporate AI Security Strategy: Define, implement, and govern the security standards, policies, and frameworks for AI/ML adoption across all business units.
• Lead Cross-Functional AI Initiatives: Act as the primary security partner for Platform, Application Engineering, and Product teams to support the responsible development and deployment of AI-powered features.
• Coordinate and Mentor Security Teams: Champion security culture by coordinating activities with Tech Leads, Engineering Managers, and the Security Champions network, providing guidance on secure design patterns for AI workloads.
• Oversee MLSecOps and SSDLC Integration: Architect and enforce the integration of advanced security controls, automated testing, and vulnerability management within CI/CD pipelines, DevSecOps, and MLSecOps workflows.
• Manage AI Risk and Threat Modeling: Conduct comprehensive security architecture reviews and risk assessments focusing on Large Language Models (LLMs) and Generative AI, mitigating risks like prompt injection, data poisoning, and model supply chain vulnerabilities (OWASP LLM Top 10).
• Incident Response Leadership: Lead investigation, mitigation, and recovery efforts for complex security incidents, with a specialized focus on threats targeting AI infrastructure, inference endpoints, and managed cloud AI services (e.g., Azure OpenAI, AWS Bedrock)
• Continuous Security Evolution: Monitor emerging cybersecurity trends, adversarial ML tactics, and global compliance regulations to preemptively evolve Enhesa’s security infrastructure against future vectors.

Key requirements

Education Level

Bachelor’s or advanced degree in computer science, artificial intelligence, mathematics, or related field or professional cybersecurity certifications in lieu of a formal degree.

Experience

At least 3 years of experience as cybersecurity professional, with at least 3 year in AI/ML security, LLM security, or security for AI-driven systems

Technical Skills:

• Application Security (AppSec) and Secure Software Development Lifecycle (SSDLC): familiarity with integrating security practices into CI/CD pipelines, code review processes, DevSecOps and MLSecOps workflows.
• OWASP Top 10 and OWASP LLM Top 10: solid understanding of common web application vulnerabilities and their AI/LLM-specific equivalents (e.g. prompt injection, insecure output handling, model supply chain risks).
• AI/ML Security: understanding of threat vectors specific to AI systems, including adversarial attacks, data poisoning, model inversion, and securing inference endpoints.
• Knowledge of networks (TCP/IP, LAN/WAN) Must possess a solid understanding of networking basics, including TCP/IP protocols, and the configuration and operation of both Local Area Networks (LAN) and wide Area Networks (WAN). Awareness of how these networks facilitate communication and the potential security implications is essential.
• Basic familiarity with the OSI (Open Systems Interconnection) model, including the understanding of its seven layers and how they contribute to network communications and cybersecurity practices.
• Security protocols, for example: (HTTPS, DNS, SMTP, FTP, SSH).
• Firewalls (IDS/IPS) familiar with the concepts and purposes of these tools.
• Understanding of information security principles, such as confidentiality, integrity, and availability.
• Familiarity with operating systems, especially Windows, Linux or Unix, and MacOS.
• Knowledge and familiarity with incident investigation and response processes.
• Specific Knowledge and Skills such as programming languages (Python, PowerShell); familiarity with API security testing and secure coding practices in web application stacks
• Knowledge of securing cloud environments (AWS, Azure, GCP), including experience securing AI/ML workloads and managed AI services (e.g. Azure OpenAI, AWS Bedrock, GCP Vertex AI)
• Familiarity with concepts like IAM (Identity and Access Management), encryption in transit and at rest, and shared responsibility models.
• Understanding of securing virtual machines and containerized environments.

Certifications

At least one AI security certification is required, such as: AAISM (Accredited AI Security Manager) or CompTIA SecurityAI+ (SecAI+). Other relevant certifications (e.g. CISSP, CEH, CCSP) are a plus.

Other Skills:

• Any other core skills to bring to the team are a huge plus, such as front-end development, experience administering cloud systems, deploying serverless cloud technology, deep Linux knowledge, etc.
• Fluency in English. Any additional language skills are an asset.
• In order to fit in Enhesa’s collaborative and international environment, creativity, dynamics, and ability to work independently yet transparently towards colleagues.
• Strong teamwork skills, both with colleagues as well as with external partners.
• Both individual and team problem-solving skills are crucial in this position.