Security
Protecting the business from threats and proving trust. Covers information security, application security, security operations/SOC, penetration testing, trust & safety (enforcement/detection), cloud security, incident response, threat intelligence, GRC (security context), and security architecture.
Roles
The canonical roles within Security.
Trust & Safety
Professionals in this role build and operate the systems that detect, investigate, and enforce against abuse of AI platforms—from fraud and policy violations to malicious cyber misuse. They translate safety policies into automated detection logic, machine learning features, and backend workflows, then partner with specialists, engineers, and product teams to turn signals into enforcement actions. The work combines real-time technical problem-solving with operational rigor: designing detection systems that act in milliseconds, managing feedback loops from chargebacks and support teams, and scaling enforcement without breaking legitimate users. These roles typically sit within dedicated Trust & Safety or Safeguards teams embedded in product organizations, working closely with policy, legal, investigations, and engineering to protect platform integrity while balancing user experience and business constraints.
Detection & Incident Response
Engineers in this role design and operate detection systems that identify security threats across AI infrastructure, cloud environments, and enterprise platforms, then lead investigations when incidents occur. They combine deep technical expertise in SIEM/SOAR platforms, forensics, and threat analysis with the ability to automate response workflows and mentor teams on detection improvements. These roles typically sit within dedicated Security Operations or Detection & Response teams at AI-native companies, where they bridge the gap between passive monitoring and proactive threat hunting while scaling security capabilities alongside rapid infrastructure growth.
Security Engineer
Security engineers in this role span multiple domains—application, infrastructure, and cloud security—while building the technical foundations that enable AI platforms to operate safely at scale. They write production code to automate detection and remediation, partner with engineering teams on authentication and access control design, and navigate the unique security challenges of AI systems handling sensitive customer data and agent workloads. These roles typically sit within dedicated security teams at growth-stage AI companies, working cross-functionally to embed security practices into development workflows while maintaining enterprise compliance standards like SOC 2 and ISO 27001.
Infrastructure & Cloud Security Engineer
Engineers in this role design and implement security controls across GPU compute clusters, multi-cloud environments, and distributed infrastructure that power AI platforms. They work hands-on with Kubernetes, networking, identity systems, and CI/CD pipelines to establish Zero Trust principles and secure model weights, inference endpoints, and customer data at scale. What distinguishes this work is the focus on protecting specialized AI workloads—from GPU execution environments to model deployment systems—while enabling rapid infrastructure scaling. These engineers typically sit within dedicated security teams reporting to the CISO, partnering closely with platform, infrastructure, and ML engineering teams to shift security left and make secure-by-default systems the easiest path for developers.
Security GRC & Compliance
This role builds and operates the governance, risk, and compliance infrastructure that enables AI companies to scale safely and securely. Professionals develop policies, manage audits, and automate control evidence across frameworks like SOC 2, ISO 27001, and FedRAMP while partnering closely with engineering teams to embed security into products rather than bolt it on afterward. Unlike traditional compliance roles focused on documentation, these positions emphasize continuous monitoring, compliance-as-code automation, and using data pipelines to turn governance into measurable, verifiable systems that support both business velocity and audit readiness.
Physical Security
Physical Security professionals in AI companies monitor and protect critical infrastructure including data centers, corporate facilities, and supply chains that power AI compute and development. They operate security operations centers tracking access control, video surveillance, and intrusion detection systems; manage facility clearances and personnel security programs for regulated government contracts; design and oversee construction of secure facilities; and lead incident response and business continuity planning when threats materialize. These roles differ from IT security by focusing on threats to physical assets and personnel rather than information systems, and from facilities management by prioritizing security governance over operational efficiency. Physical Security teams typically sit within dedicated security organizations and work cross-functionally with real estate, operations, legal, and emergency response partners to ensure that the infrastructure underpinning AI development remains protected from theft, sabotage, unauthorized access, and disruption.
Application Security Engineer
This role conducts comprehensive security reviews and threat modeling across AI-native platforms and data infrastructure, identifying vulnerabilities in applications that power enterprise AI agents, LLM systems, and knowledge graphs. What distinguishes Application Security Engineers from broader security roles is their focus on embedding security into the development lifecycle itself—through code reviews, secure design practices, and CI/CD integration—rather than conducting external assessments alone. These engineers typically sit within dedicated product or application security teams that partner closely with engineering organizations, translating security requirements into developer-friendly practices and tooling that enable teams to ship secure code at scale.
Security Leader
Security leaders at AI companies design and operate comprehensive security programs spanning cloud infrastructure, identity systems, threat detection, and compliance frameworks. They balance hands-on technical depth—from architecting zero-trust models and securing AI/LLM pipelines to investigating incidents directly—with executive-level strategy and customer-facing credibility. Unlike pure compliance officers, these leaders embed security throughout engineering organizations and product development, treating it as an enabler of velocity rather than a brake, while typically reporting to the CISO and managing growing teams across security operations, architecture, and engineering disciplines.
Offensive Security & Red Team
Engineers in this role execute offensive security assessments and red team operations across AI company infrastructure, applications, and—critically—AI-specific attack surfaces including prompt injection, model exfiltration, agent abuse, and tool-use exploitation. They combine hands-on penetration testing and adversarial simulation with custom tooling development, performing both rapid, targeted engagements and comprehensive open-scope operations that validate detection and response capabilities end-to-end. What sets this work apart is the focus on emerging AI risks: engineers assess production language models, agentic systems, and ML pipelines alongside traditional cloud, Kubernetes, and endpoint surfaces. They sit within the security function, partnering closely with defensive teams and product engineering to identify vulnerabilities early in design, then translate findings into actionable risk narratives that drive remediation and inform broader security strategy.
Identity & Access Management
Engineers in this role architect and operate identity systems that secure access across distributed AI infrastructure, multi-tenant platforms, and cloud environments serving thousands of users and services. They combine hands-on engineering—writing infrastructure-as-code, building authentication flows, automating provisioning workflows—with strategic design, setting long-term direction for how identity evolves alongside rapidly scaling AI platforms. Unlike general security roles, they specialize deeply in identity primitives like SSO, RBAC, service account management, and agentic AI workload access, often working across multiple cloud providers and compliance frameworks like FedRAMP. These engineers typically sit within dedicated security or trust teams, partnering closely with platform, infrastructure, and compliance functions to embed identity into every layer of the stack.
Recent Jobs
The latest Security openings across the AI industry.