AI Security Engineer, Senior Associate

About Alvarez & Marsal

Alvarez & Marsal (A&M) is a global consulting firm with entrepreneurial, action and results-oriented professionals.

We take a hands-on approach to solving our clients' problems and assisting them in reaching their potential.

Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry.

The collaborative environment and engaging work—guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity—are why our people love working at A&M.

Description

Alvarez & Marsal (A&M) is a global consulting firm with entrepreneurial, action and results-oriented professionals.

We take a hands-on approach to solving our clients' problems and assisting them in reaching their potential.

Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry.

The collaborative environment and engaging work—guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity—are why our people love working at A&M.

The Team

The Senior Associate, Security Engineer (AI) is a specialist role within the Security Engineering team, focused on the security and governance of A&M's enterprise AI platforms.

The role sits at the intersection of security engineering, cloud security, and AI governance, and will work closely with the wider Global Security Office, GRC, Legal, and business technology teams.

This is a hands-on technical role.

The primary focus is on owning and operating AI security controls within Sec Eng's scope, contributing AI security input into cross-functional programmes, and building out the firm's AI security capability in a nascent but high-priority space.

• How you will contribute
• The following are the specific outcomes this role is expected to own within Sec

Eng

• AI Platform Security
• Lead the security assessment, onboarding, and hardening of A&M's enterprise AI platform deployments, defining and implementing controls spanning data governance, access management, audit logging, DLP integration, and network security across all environments.
• Act as the Sec Eng subject matter expert for AI security and governance controls, including tooling such as Harmonic, and take ownership of securing enterprise AI applications (e. g.

Claude, Claude Code, Claude Cowork).

• Build and operationalise a continuous AI security monitoring capability within Sec Eng, including detection logic for anomalous usage patterns, data leakage indicators, and policy violations within A&M's deployed AI tools.
• Integrate AI security considerations into Sec Eng's broader engineering roadmap, including vulnerability management and cloud security posture management.
• Serve as the primary technical liaison with AI platform vendors' security team, maintaining awareness of vendor updates, new capabilities, and security advisories that may affect A&M's deployments.
• Threat Modelling and Risk
• Develop and maintain the technical AI security threat model for A&M, identifying attack surfaces unique to LLM-based platforms and mapping technical mitigating controls to each risk scenario.

This work is expected to be conducted in collaboration with the SOC/Threat Intelligence, GRC, and Legal/Privacy functions, each of whom contribute to the broader AI risk picture.

• Apply knowledge of Secure Software Development Lifecycle (S-SDLC) and IDE security to assess risks introduced by AI-assisted coding tools and developer workflows, partnering with digital and technology teams across A&M's business units who are actively building AI-integrated solutions.
• Cross-Functional Contributions
• Role

The role will contribute Sec Eng's technical expertise into the following cross-functional programmes, where ownership of outcomes rests with the relevant function:

• Support GRC in developing and maintaining an AI Risk Register by providing technical risk input, control mapping, and evidence - GRC owns the register as a governance deliverable.
• Contribute AI-specific platform controls, logging, and containment options to Incident Response's AI security playbooks - IR owns the playbook and response process.
• Work with the Security Awareness team to develop technically accurate training content on the secure and compliant use of A&M's AI platforms.
• Engage with Legal, Privacy, and Compliance stakeholders to provide technical input into A&M's AI governance obligations under GDPR, client contractual requirements, and applicable data sovereignty regulations.
• Contribute the Sec Eng perspective into cross-functional AI governance working groups, supporting strategic decisions on AI tool adoption, expansion, and policy evolution.
• Participate in A&M's Security Assurance Review (SAR) process, providing technical security input into AI-driven development and tooling assessments.

Qualifications

Essential

• A minimum of 3 years’ experience in AI security, with demonstrable expertise in serving as the subject matter expert for AI security and governance controls.
• A minimum of 4-years of progressive experience in cybersecurity, with a strong security engineering or cloud security foundation.
• Demonstrable interest in or exposure to AI/ML security, LLM security, or the security of intelligent systems.
• Hands-on experience securing enterprise Saa S platforms, with experience or strong interest in AI-powered productivity tools or LLM deployments.
• Prior involvement in AI security assessments, AI governance programmes, or vendor security evaluations for AI platforms.
• Cloud and platform security: proficiency in cloud security across Microsoft Azure, including cloud-native security controls, CSPM tooling, and secure API gateway configuration, with familiarity in API security principles for hardening integrations between enterprise systems and third-party AI providers.
• Understanding of enterprise identity and access management (IAM), including zero-trust architectures, role-based access control (RBAC), and privileged access management (PAM).
• Familiarity with AI-specific threat scenarios such as prompt injection, data exfiltration via model outputs, training data poisoning, and adversarial inputs.
• Data classification and handling: experience with data classification frameworks and the application of data handling policies within AI tools to prevent sensitive information from being exposed or retained inappropriately.
• Bachelor's degree in Computer Science, Information Security, Cybersecurity, Engineering, or a closely related technical discipline.

Equivalent professional experience will be considered.

• A relevant professional certification in cybersecurity, such as one of: CISSP, CISM, CCSP, CEH, OSCP, AZ-500, or an equivalent qualification appropriate to the candidate's experience level.

Candidates actively working towards certification will also be considered.

Desirable

• Experience working within professional services, financial services, consulting, or similarly regulated industries.
• Experience contributing to enterprise security assurance programmes or red team exercises, including in AI/ML contexts.
• Regulatory and standards knowledge: familiarity with relevant regulatory frameworks and standards including ISO 42001, ISO 27001, SOC 2, GDPR, NIST AI RMF, and the EU AI Act as they pertain to enterprise AI deployments.
• Scripting and automation: scripting or programming skills (Python, Power Shell, or similar) sufficient to automate security workflows, write detection rules, and analyse telemetry from AI platform usage.
• Security monitoring tooling: working knowledge of SIEM platforms, DLP solutions, CASB tooling, and endpoint detection technologies as they relate to AI usage monitoring.
• Secure development practices: knowledge of Secure Software Development Lifecycle (S-SDLC) principles and IDE security controls, including the assessment of AI-powered coding assistants and their potential to introduce risk in software development workflows.
• Postgraduate degree (MSc or equivalent) in Cybersecurity, AI, Data Science, or a related field.
• Certification or demonstrated expertise in AI or machine learning security, such as those offered by GIAC (e. g.

GAISC), or completion of recognised AI security training programmes from MITRE, NIST, or equivalent bodies.

• Certification in cloud security, such as Microsoft Certified: Azure Security Engineer Associate (AZ-500) or Microsoft Cybersecurity Architect Expert (SC-100).
• Completion of enterprise AI administrator or security training from one or more major AI platform vendors (such as Microsoft, Google, Anthropic, or Open AI) or equivalent vendor-accredited security education.
• Personal Competencies

The successful candidate will be a technically curious, pragmatic security professional who is comfortable building frameworks and controls in a nascent, ambiguous discipline; who communicates and collaborates confidently across all levels of the organisation; who upholds the highest standards of integrity, discretion, and ethical AI practice; and who brings the resilience, organisation, attention to detail, and proactive ownership needed to manage multiple concurrent priorities in a fast-moving global environment.

Your journey at A&M

We recognize that our people are the driving force behind our success, which is why we prioritize an employee experience that fosters each person’s unique professional and personal development.

Our robust performance development process promotes continuous learning, rewards your contributions, and foster…

#J-18808-Ljbffr