Sr AI Engineer, Security

News Corp (Realtor.com) is seeking a senior AI security engineer to secure AI and agent platforms across AWS and GCP. This role focuses on guardrails, containment, supply chain integrity, detection and response, and threat modeling, while helping educate teams and lead AI security strategy. Location

Austin, TX, United States

(Onsite) Key Responsibilities

Secure the AI platform across

AWS and GCP . Design and enforce

guardrails

for AI workloads on

AWS

(Bedrock, Lambda, IAM, KMS, SCPs, GuardDuty, Security Hub) and on

GCP

(Vertex AI, IAM, VPC Service Controls, Org Policies, Security Command Center, Cloud KMS). Define identification and authorization for agents and other non-human accounts using

short-lived, narrowly scoped credentials ,

delegated user permissions , and a

per-agent audit trail

to limit blast radius from misbehavior. Build agent

containment

including separation of read and write permissions, network egress controls, sandboxed execution, approval gates for high-risk actions, and kill switches. Design an

agent gateway

or

control plane

that restricts agents and their tool calls to approved limits. Secure the

AI supply chain

by controlling model sources and scanning processes, including unsafe formats such as pickle; vet models and datasets from public hubs such as Hugging Face; manage an approval process for new MCP servers and agent tools; and maintain an inventory of the models, data, and tools used by each system (AI-BOM). Defend against

prompt injection , tool poisoning,

RAG poisoning , and sensitive data leakage. Implement

detection and logging

for agent and model activity and own

AI-specific incident response playbooks . Lead

threat modeling

for new products, features, and internal solutions, applying frameworks such as

STRIDE , the

OWASP LLM/GenAI Top 10 ,

MITRE ATLAS , and

OWASP ASVS , and convert findings into design requirements and release criteria. Review pull requests and architecture designs for apps through agent fleets, providing concrete suggestions that move work forward. Develop paved-road

secure-by-default frameworks , reference architectures, and templates to prevent whole categories of risk. Embed security into

CI/CD

through secrets scanning, SAST/SCA, GitHub Actions hardening, and policy-as-code in Terraform. Run an ongoing

red-team and evaluation

program for models, agents, and LLM apps, testing new AI capabilities before launch. Partner with News Corp’s global cybersecurity team to align Realtor.com AI and cloud security with group-wide standards, policies, and risk frameworks. Coordinate on incident response, threat intelligence, and vulnerability disclosure across News Corp businesses. Share AI security patterns, threat models, and lessons learned across the organization, and bring insights back to Realtor.com. Build agents that support security work such as triaging findings, investigating alerts, auditing IAM for least privilege, and opening tested secure-by-default fix pull requests. Use Claude Code, Devin, and MCP to increase security team productivity and share these patterns with other engineering teams. Track emerging AI threats, incidents, research, and vendor capabilities, and translate them into actions for the platform. In major industry incidents, quickly assess potential exposure and lead response activities. Prototype new approaches when existing tools and best practices do not fit, run small experiments, measure outcomes, and standardize what works. Write short internal briefings on major developments and recommend when to adopt, pilot, or skip tools and practices. Create and deliver

AI security training

for engineers, product teams, and the wider company, covering prompt injection, data leakage, excessive agency, and secure use of Claude, Glean, Devin, and Gemini. Act as the security voice in AI platform strategy by evaluating vendors and models, setting the bar for production readiness, and shaping AI governance across the AI lifecycle. Brief leadership on AI risk and investment areas. Represent Realtor.com externally through conference talks, open-source work, or industry working groups. Minimum Requirements

5+ years

in cybersecurity, cloud security, AppSec/product security, or security platform engineering. Hands-on depth in

AWS security

and real experience in

GCP

(or strong multi-cloud background). Approach security through

permissions, scopes, logs, approval gates, data boundaries, and rollback . Experience securing

LLM or agentic systems , including prompt injection defenses, retrieval and data-boundary risks, agent identity, and model or tool supply-chain integrity. Threat modeling experience for products and platforms, including leading sessions with engineers and product managers and turning results into requirements. Hands-on experience building with

agents, tool calling, or MCP , and with AI coding tools. Strong code-review skills in at least one of

Python, TypeScript, or Go , plus comfort with

Terraform/IaC . Experience with

zero trust ,

least privilege ,

SSO/OIDC/OAuth , secrets management, and vulnerability management. Experience working within a larger security organization, such as a parent company, central team, or federated model, balancing local speed with enterprise alignment. Ability to follow AI security research and incident write-ups, and apply recent learnings. A builder’s mindset, including prototyping new controls and operating where playbooks may not exist. Ability to explain risk clearly to varied audiences, from PR comments to executives and company-wide training. Technologies

AWS, GCP, Bedrock, Lambda, IAM, KMS, SCPs, GuardDuty, Security Hub Vertex AI, VPC Service Controls, Org Policies, Security Command Center, Cloud KMS Hugging Face, MCP, Claude Code, Devin, Claude, Glean, Gemini Python, TypeScript, Go, Terraform, CI/CD, GitHub Actions, SAST, SCA STRIDE, OWASP LLM/GenAI Top 10, MITRE ATLAS, OWASP ASVS RAG, pickles Benefits

Inclusive and competitive medical, Rx, dental, and vision coverage Family forming benefits 13 paid holidays Flexible time off 8 hours of paid volunteer time off Immediate eligibility into the Company 401(k) plan with 3.5% company match Tuition reimbursement program for degreed and non-degreed programs 1:1 personalized financial planning sessions Student Debt Retirement Savings Match program Free snacks and refreshments in each office location Nice to Have

AWS Security Specialty, Google Professional Cloud Security Engineer, CCSP, CISSP, OSCP, or GIAC (GCSA/GWEB) Experience red-teaming or evaluating AI models or agents Familiarity with NIST AI RMF, ISO 42001, Google SAIF, CoSAI, NIST SSDF, or the EU AI Act Experience securing Snowflake (RBAC, masking, network policy) Conference talks, published research, or open-source security contributions How We Work

News Corp balances creativity and innovation on a foundation of in-person collaboration. For most roles, employees work four or more days in the office to collaborate in person and strengthen company culture.

#J-18808-Ljbffr