AI Security Engineer

ConRes helps organizations adopt AI across public cloud, government cloud, and local and air-gapped data centers. As clients move AI from pilots into production, their security, compliance and audit teams need an independent answer to one question: is this AI system safe to run? The AI Security Engineer provides that answer.

You will assess, test and help govern our clients' AI systems, and turn findings into prioritized, defensible remediation they can act on.

Responsibilities

AI Security Assessments

• Lead AI security assessments of LLM applications, RAG pipelines and AI agents: architecture review, data flows, identity, tenancy and data separation, logging and model-provider configuration.
• Run threat-modeling workshops using STRIDE with the OWASP Top 10 for LLM Applications, OWASP Agentic AI guidance and MITRE ATLAS.
• Map findings to AI frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) and to the client's control baseline (NIST SP 800-53, NIST SP 800-171 / CMMC, FedRAMP, HIPAA, PCI DSS, SOC 2, ISO/IEC 27001) so stakeholders can defend severity and remediation decisions and produce audit-ready evidence.
• Write executive-ready reports and present results to client security, compliance and leadership teams.

Adversarial Testing

• Plan and execute AI red-team exercises: direct and indirect prompt injection, jailbreaks, system-prompt and data leakage, insecure output handling, excessive agency and tool abuse in agents, RAG and vector-store poisoning.
• Validate that guardrails and content filters (native guardrail services in public and government cloud, and self-hosted guardrail models in air-gapped environments) actually hold under attack.

Local and Air-gapped AI Deployments

• Define and verify security controls for self-hosted and air-gapped AI: inference servers (i.e., vLLM, Ollama, NVIDIA NIM), GPU hosts, local vector stores and the networks around them.
• Secure the model supply chain without internet access: provenance and hash/signature verification of model weights, scanning for unsafe serialization, and an approved internal model and package registry.
• Design and audit controlled data-transfer processes for moving models, updates, containers and datasets across the air gap.
• Harden hosts and containers; ensure logging, monitoring and incident response work without cloud services.
• Assess data-isolation guarantees and document them for accreditors and auditors.

AI Governance and Risk

• Help clients develop AI acceptable-use, data-handling and model/vendor risk standards suited to their regulatory obligations.
• Assess the AI vendors and SaaS tools clients are adopting: data residency, retention, training-data use, SOC 2 / ISO 42001 posture.
• Define AI security requirements and acceptance criteria for client solutions, working with the client's teams and ConRes delivery teams.
• Help clients detect and manage shadow AI and AI-related data loss (data classification, DLP and AI threat-protection tooling).

Incident Response and Enablement

• Support clients in investigating and responding to AI-related incidents: data leakage, model abuse, compromised AI identities or keys.
• Track emerging AI attack techniques and regulation, and keep client assessments and test cases current.
• Deliver AI security training and workshops for client teams, and help shape ConRes's AI security services and thought leadership.

The pay range for this position begins at $180,000 up to $200,000 per year.
This range reflects the annual salary that Continental Resources reasonably and in good faith expects to pay for this position at the time of posting, consistent with the Massachusetts Pay Transparency Law (M.G.L. c. 149, § 105E).

#ConRes

Requirements

• 5+ years in information security (application security, cloud security, penetration testing or security architecture), including 2+ years focused on AI/ML or LLM security.
• Hands-on experience testing LLM applications or agents for prompt injection, jailbreaks and data leakage.
• Strong, hands-on experience securing local and air-gapped AI deployments: self-hosted open-weight models, offline model and package supply chains, cross-domain transfer, and host hardening.
• Working knowledge of OWASP Top 10 for LLM Applications, MITRE ATLAS and NIST AI RMF.
• Familiarity with compliance frameworks and audit evidence: NIST SP 800-53, NIST SP 800-171 / CMMC, FedRAMP, HIPAA, SOC 2, ISO/IEC 27001 and ISO/IEC 42001.
• Strong understanding of how LLM apps, RAG and agent frameworks (including MCP) are built, enough to find where they break.
• Security experience across public cloud, government cloud (FedRAMP / DoD IL environments) and local or air-gapped data centers: identity, network isolation, key management, logging.
• Python scripting for test automation and analysis.
• Clear written and verbal communication; comfortable leading client workshops and presenting technical risk to executives and auditors.

Preferred

• Prior consulting or professional-services experience.
• Experience with healthcare (HIPAA/PHI), financial-services or defense/government compliance, including supporting an ATO or CMMC assessment.
• Certifications such as OSCP, GWAPT, CISSP, CCSP, IAPP AIGP, ISO/IEC 42001 Lead Auditor, CompTIA SecAI+ or cloud-provider certifications.
• Published AI security research, CVEs, bug-bounty findings or AI CTF participation.