Staff Security Engineer [Remote-US]

Quanata is an insurance technology innovation company that develops risk prediction and prevention solutions and digital, AI-enabled insurance platforms. The Staff Security Engineer will secure AI-enabled systems, applications, platforms, cloud infrastructure, and development environments while leading threat modeling, architecture reviews, security standards, and cross-functional security initiatives.

Responsibilities:

• Partner with engineering and product teams to embed security into AI-enabled products, internal applications, APIs, services, and platforms throughout their lifecycle
• Lead threat modeling, security architecture reviews, and risk assessments for LLM applications, RAG pipelines, agentic workflows, MCP servers, model providers, third-party AI tools, plugins, automations, and AI-assisted development
• Define and implement secure AI engineering patterns, guardrails, standards, and reference architectures across identity, data protection, prompt and context handling, tool permissions, logging, monitoring, abuse prevention, and incident readiness
• Strengthen AWS-native infrastructure and CI/CD environments, including infrastructure-as-code, containerized workloads, secrets management, workload identity, deployment pipelines, and software supply chain controls
• Partner with security operations, detection engineering, incident response, and vulnerability management teams to improve AI-related detection, observability, telemetry, and response capabilities
• Evaluate AI applications, SaaS platforms, model providers, MCPs, agents, developer tools, and other third-party technologies for security, privacy, access, data exposure, logging, contractual, and operational risks
• Develop practical security guidance, training, and enablement materials that help engineering and business teams use AI safely and build secure solutions
• Lead cross-functional security-by-design initiatives, translate security objectives into technical requirements, influence architectural decisions, and take ownership of broader security projects and critical incident response efforts as organizational needs evolve

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related technical field; an equivalent combination of education and relevant experience; or equivalent relevant experience
• 8+ years of experience in full-stack security, product security, application security, cloud security, DevSecOps, infrastructure security, or software engineering with significant security responsibilities
• 5+ years of demonstrated experience working with AI, machine learning, LLM, GenAI, or AI-enabled application environments, including hands-on experience securing, assessing, building, integrating, or operating AI-enabled systems
• Proven experience conducting security architecture reviews, threat modeling, secure design reviews, code or configuration reviews, and risk assessments for modern applications, APIs, platforms, and distributed systems
• Experience evaluating and securing third-party SaaS platforms, AI tools, model providers, developer tools, APIs, integrations, and vendor-managed services
• Experience partnering across security operations, detection engineering, incident response, GRC, privacy, infrastructure, and product engineering teams
• Strong hands-on experience securing cloud-native environments, preferably AWS, including IAM, networking, logging, monitoring, secrets management, workload identity, infrastructure-as-code, and secure deployment practices
• Strong understanding of modern CI/CD pipelines, source control, build systems, artifact management, deployment automation, container security, software delivery workflows, and software supply chain risk
• Working knowledge of AI-specific security risks, including prompt injection, insecure tool use, excessive agency, data leakage, sensitive data exposure, RAG security risks, model and provider trust boundaries, plugin and MCP risks, insecure agent permissions, model extraction, model abuse, and AI supply chain concerns
• Ability to translate AI and cloud security risks into practical engineering requirements, compensating controls, standards, detections, and operational procedures
• Strong written and verbal communication skills, with the ability to explain complex technical risks, document standards, influence decisions, and drive remediation across technical and business teams
• Demonstrated ability to work independently, self-organize, prioritize competing risks, and lead complex cross-functional security initiatives from concept through execution
• Location : We are a remote-first company for most positions so you may work from anywhere you like in the U.S, excluding U.S. territories
• For most positions, occasional travel may be requested or encouraged but is not required . Some positions might require travel per the job description provided to the employee
• Hours : We maintain core meeting hours from 9AM - 2PM Pacific time for collaborating with team members across all time zones
• Experience securing agentic AI systems, MCP servers, AI agents, tool-calling or autonomous workflows, internal copilots, LLM gateways, AI assistants, or AI-enabled developer productivity tools
• Experience with AWS AI/ML and GenAI services such as Amazon Bedrock, SageMaker, Comprehend, Transcribe, Textract, or related AWS-native capabilities
• Experience securing RAG architectures, vector databases, embedding pipelines, knowledge retrieval systems, data classification workflows, and sensitive data within AI applications
• Experience implementing AI security guardrails such as model access controls, approved-provider patterns, prompt and context protections, DLP integrations, logging requirements, policy enforcement, and AI usage monitoring
• Experience with detection engineering, SIEM/SOAR platforms, cloud security posture management, vulnerability management, endpoint security, or related security operations tooling
• Experience developing secure software in Python, TypeScript, JavaScript, Go, Java, or similar languages
• Experience with Kubernetes, Docker, Terraform, GitHub Actions, GitLab CI/CD, Jenkins, or similar cloud-native and DevOps technologies
• Familiarity with frameworks and guidance such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI Risk Management Framework, CIS benchmarks, SOC 2, ISO 27001, or cloud security reference architectures
• Relevant certifications such as AWS Certified Security – Specialty, CISSP, CSSLP, CCSP, GIAC, OSCP, or other cloud, application security, AI security, or security engineering certifications
• Experience as a senior individual contributor influencing engineering teams, establishing security standards, and delivering security outcomes without direct management authority