Sr AI Software Security Engineer

Evolent Health LLC is hiring a Senior AI Software Security Engineer to secure its critical infrastructure, AI implementations, and applications. The role leads application security, threat analysis, penetration testing, vulnerability mitigation, and security initiatives in collaboration with cross-functional teams.

Responsibilities:

• Conduct and/or review software composition analysis and source code reviews for repositories, ensuring vulnerabilities like misconfigurations (e.g., log4net) are mitigated
• Perform and/or review static and dynamic application security testing (SAST/DAST) and maintain a comprehensive security dashboard for management insights
• Implement and/or review HTTP security headers and secure web configurations for applications
• Participate in the secure design, development, and deployment of complex AI software solutions, ensuring scalability and maintainability
• Participate in the design and implementation of high-performance APIs and microservices that support critical business functions
• Collaborate closely with cross-functional teams, including product managers, UX designers, and other engineers, to translate business needs into technical solutions
• Conduct thorough AI environmental and code reviews, providing constructive feedback and ensuring adherence to best coding practices
• Mentor and coach IT software and AI engineers, fostering a culture of continuous learning and technical excellence in the Security domain
• Identify and implement improvements to the software and/or AI development lifecycle, including automation, testing, and CI/CD pipelines
• Troubleshoot and resolve production issues, working to ensure high availability and reliability of services
• Evaluate and integrate new tools, frameworks, and technologies to improve development processes and team productivity
• Drive the technical vision for projects, contributing to architectural discussions and long-term planning
• Lead annual and quarterly penetration tests of proprietary and critical applications, identifying and addressing high-priority vulnerabilities
• Oversee third-party penetration testing activities and ensure actionable outputs are delivered and resolved effectively
• Perform ad-hoc and on-demand penetration testing within established timelines
• Implement deception technologies (e.g., Zscaler) with internal and external decoys for advanced threat detection
• Work with the Threat Intelligence team to mitigate zero-day vulnerabilities and other emerging threats
• Conduct quarterly targeted network penetration testing to identify and mitigate risks, such as default credentials
• Enable and manage MFA for critical systems, including Evolent.com and CMS platforms
• Perform and/or review configuration and optimization of Security tools
• Perform and/or review development and enforcment file integrity monitoring rules for critical AI functions
• Enhance CI/CD pipeline security for platforms like GitHub, Jenkins, and Azure DevOps
• Mentor and coach IT software and AI engineers, fostering a culture of continuous learning and technical excellence in the Security domain
• Facilitate training sessions and knowledge-sharing activities with AI development teams to improve secure coding practices
• Actively participate in Red Team/Blue Team exercises and tabletop simulations
• Work closely with cross-functional teams to address security findings and enhance AI and application modules
• Collaborate with teams to secure cloud storage solutions, including S3 and Azure Storage