AI Security Engineer

Job Description: UW Information Technology has an outstanding opportunity for AI Security Engineerto join their team. About this Opportunity Reporting to Technology Manager, the AI Security Engineer will support the security, governance, and compliance of artificial intelligence (AI) initiatives at the university and its three campuses. The AI Security Engineer exists to secure the university's AI platforms, primarily Purple, built on Cloudforce nebulaONE and hosted in Azure AI Foundry, ensuring that AI services delivered to over 50,000 faculty, staff, and students across three campuses operate within a robust, compliant, and trustworthy security framework. Key Responsibilities[30%] Security Engineering-Implement and maintain security controls for AI platforms within Microsoft Azure, including network security groups, firewalls, encryption, key management, and secure landing zones aligned with the Azure Well-Architected Framework (security pillar) and the Microsoft cloud security benchmark.- Configure and manage identity and access management using Entra ID, RBAC, conditional access policies, and Zero Trust architecture principles across management-group and subscription hierarchies.[20%] Security Automation & Infrastructure-as-Code (DevSecOps).- Implement and maintain infrastructure-as-code (IaC) security using Bicep and/or Terraform, including policy-as-code enforcement (Azure Policy, Sentinel policies) and IaC scanning in CI/CD pipelines.- Embed security into CI/CD pipelines (DevSecOps) using GitHub Advanced Security or equivalent, including SAST, DAST, SCA, container image scanning, and auto-remediation workflows.- Develop security automation scripts and tools (Python, PowerShell, Bash) to streamline vulnerability scanning, configuration hardening, and compliance evidence collection.[20%] AI Application Security & Red-Teaming- Support the security of AI application-layer components specific to Purple and nebulaONE, including RAG data isolation, least-privilege tool/function-call authorization, agent action budgets and rate limits, output filtering, and secrets isolation.- Participate in recurring red-team exercises against AI platforms mapped to the OWASP LLM Top 10, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS, documenting findings and supporting remediation.- Assess and help mitigate AI-specific security risks including prompt injection, jailbreak attacks, data leakage through model outputs, and adversarial attacks.- Support implementation of guardrails for LLM and agent application patterns including RAG, tool/function calling, MCP (Model Context Protocol), and multi-agent orchestration workflows.- Apply AI security governance practices aligned with the NIST AI Risk Management Framework (AI RMF), the NIST Generative AI Profile, and ISO/IEC 42001.[15%] Compliance Evidence & Vendor Oversight- Produce and maintain compliance evidence (not policy) for FERPA, HIPAA (where PHI is in scope, including areas outside UW Medicine), GLBA, NIST 800-171/CMMC, and SOC 2 as it relates to AI platforms and cloud infrastructure.- Support vendor security oversight of Cloudforce and Microsoft, including HECVAT completion/review, VPAT assessment, SOC 2 report analysis, data processing agreement reviews, and security questionnaire management.[10%] Incident Response & Security Monitoring- Monitor AI platform security posture using Azure Sentinel (SIEM), writing and tuning KQL queries for detection rules, alert triage, and threat hunting.- Maintain and execute incident response playbooks specific to AI platforms, including data breaches, unauthorized access, prompt injection attacks, model compromise, and agent misuse scenarios.- Triage and investigate security incidents, coordinate response activities with UWIT Office of Information Security, and contribute to post-incident reports with root cause analysis.[5%] Paved-Road Patterns, Documentation & Continuous Improvement- Contribute to 'paved-road' security patterns -- reusable, pre-approved templates and configurations that make the secure path the easy path for developers and administrators.- Develop and maintain security documentation, including architecture diagrams, runbooks, standard operating procedures, and incident response playbooks.- Evaluate emerging security tools and technologies; make recommendations for adoption. Required