Senior AI Security Engineer

About the Role

AI is the engine behind where Abacus is headed next, and this role works directly alongside the engineers building that future. We are looking for a Senior AI Security Engineer who is deeply technical and passionate about designing, building, and securing AI-enabled applications that support real customers in regulated healthcare environments.

This is not a traditional security review or compliance role. You will partner with Senior AI Engineers, data quality engineers, platform engineers, DevOps, product owners, and customer delivery teams throughout the development lifecycle. You will help design architectures, contribute code and automation, establish reusable security controls, review implementations, and support secure deployment and operation of Abacus Agents, MCP-based solutions, SQL and RAG agents and tools, and other AI-enabled products.

You will also help enable citizen application development by creating secure paved roads for business-built and AI-assisted applications. The emphasis is on practical engineering: helping teams move quickly while ensuring identity, data protection, authorization, observability, privacy, and compliance are built into each solution from the start.

You will also help build the secure foundations for enterprise knowledge services, including graph-backed knowledge stores and MCP-served retrieval tools that give people and AI agents governed, auditable access to company knowledge. This work spans cloud infrastructure, network, identity, and data layers, so that these services are private by default and secure by design.

This role requires working US Eastern Time (ET) hours, with core hours of 9:00 AM to 5:00 PM ET, Monday through Friday.  This is a remote role based in Pune. 

Your day to day

• Serve as the senior security engineering partner for AI product initiatives, working side by side with Senior AI Engineers and technical leads from concept and architecture through implementation, deployment, monitoring, and production support.
• Partner with product managers, tech leads, customer delivery teams, and stakeholders to translate roadmap and customer priorities into secure technical solutions, and translate AI security considerations into practical engineering decisions.
• Design, build, and secure AI-enabled applications and reusable platform capabilities, including Abacus Agents, agentic workflows, MCP servers and tools, SQL and RAG agents, model integrations, retrieval services, and customer-facing AI experiences.
• Contribute production-quality Python, security automation, reference implementations, tests, policy-as-code, and integration components that help engineering teams adopt secure patterns without slowing delivery.
• Define and implement security patterns for identity, authentication, authorization, least-privilege tool access, secrets management, tenant isolation, data classification, encryption, audit logging, telemetry, and human approval controls.
• Conduct collaborative architecture reviews and threat modeling for AI applications, including risks related to prompt injection, excessive agency, insecure tool use, sensitive-data disclosure, model and supply-chain dependencies, retrieval poisoning, and unsafe output handling.
• Build security requirements and automated controls into GitLab CI/CD, code review, testing, deployment, and release processes, including SAST, SCA, secrets detection, configuration validation, and documented risk acceptance.
• Partner with AI Engineering on model and application evaluation, logging, telemetry, and monitoring so security, privacy, reliability, and misuse scenarios are tested alongside functional quality.
• Review and support secure implementation of MCP servers, APIs, AI tools, and data connections by evaluating permissions, OAuth and API scopes, token handling, data flows, retention and training terms, vendor posture, and potential blast radius.
• Design and build private-by-default cloud foundations for AI knowledge services, including dedicated multi-account environments, private connectivity (VPC endpoint services and transit gateways), firewalled and allowlisted egress, per-account encryption keys, and Terraform-based infrastructure with least-privilege CI/CD deploy roles.
• Secure knowledge graph and retrieval platforms, including Neo4j or equivalent graph and vector stores, by designing access tiers, enforcing authorization by caller group, validating backup and restore, and ensuring agents reach data only through governed MCP tools and never through raw database access.
• Build and review MCP servers and MCP gateway integrations, including remote transport security, gateway-to-server authentication, identity propagation and its limits, tool-level access policy, and complete audit logging of every call.
• Secure ingestion and embedding pipelines that pull from systems such as Confluence, Jira, GitLab, and SharePoint, using read-only service accounts, secrets scanning before content is indexed, rejection of PHI and other regulated data, idempotent re-ingestion, and controlled access to embedding models.
• Create and maintain secure paved-road templates for citizen-developed and AI-assisted applications, and help administer platform controls for Replit Enterprise and similar development environments.
• Coach citizen developers through application registration, data classification, code scanning, secrets management, GitLab promotion, logging integration, and production readiness while maintaining a predictable review SLA.
• Partner with Privacy, Compliance, and Legal to ensure AI applications handling healthcare or customer data meet the privacy and security requirements that apply in each region where Abacus and its customers operate, such as HIPAA, HITRUST, SOC 2, GovRAMP, ISO 27001, and GDPR, including BAA, data residency, and data-boundary considerations.
• Represent Abacus credibly in customer-facing architecture and security conversations, explaining how AI-enabled solutions protect data, constrain agent actions, support auditability, and meet customer requirements.
• Balance rapid iteration and customer delivery commitments with sound security engineering judgment, and respond directly when design changes, incidents, or client escalations require hands-on technical support.

What you bring to the team

• Minimum 5+ years of experience in software engineering, security engineering, platform engineering, DevSecOps, application security, or a related technical discipline, including hands-on responsibility for production systems supporting real customers.
• Demonstrated experience designing, building, deploying, or securing AI-enabled applications in production, with hands-on depth in at least one of agents or agentic workflows, MCP, RAG, or AI application security, and working exposure across the others.
• Strong software engineering fundamentals, including Python, API design and security, testing, code review, automation, deployment practices, incident response, and configuration management.
• Ability to contribute directly to application and platform implementation through code, reusable components, security tooling, CI/CD controls, technical documentation, and reference architectures.
• Experience securing cloud-native and distributed systems, including identity and access management, authorization design, secrets management, encryption, network and API controls, logging, monitoring, and secure data flows.
• Hands-on experience with AWS (or an equivalent cloud) security architecture, including multi-account organization design and service control policies, VPC and Transit Gateway networking, PrivateLink, network firewall policy (SNI allowlisting and east-west inspection), ECS Fargate and EC2, KMS, Secrets Manager, and centralized logging such as flow logs, DNS query logs, and CloudWatch.
• Infrastructure as Code experience with Terraform, including policy scanning (for example Checkov), OIDC-based CI/CD deploy roles, and repeatable account baselines.
• Experience with graph and vector data stores, with Neo4j and Cypher preferred and comparable graph or vector database experience considered, including native vector indexes, role-based and fine-grained access control, backup and restore, and enforcement of data tiers.
• Practical knowledge of building and securing MCP servers and MCP gateways, including remote server authentication, OAuth/OIDC and enterprise SSO (for example Microsoft Entra ID), and audit trails.
• Experience designing secure RAG ingestion pipelines, including content chunking and embedding, embedding model governance (for example Amazon Bedrock or OpenAI-compatible services), index versioning, secrets and sensitive-data detection before indexing, and data classification tiers.
• Working knowledge of AI security risks and controls, including prompt injection, tool misuse, excessive permissions, sensitive-data exposure, insecure output handling, retrieval integrity, model and dependency risks, and auditability of agent actions.
• Experience collaborating with senior engineers and technical leads during architecture and implementation, with the technical credibility to influence decisions and the judgment to balance delivery speed, customer needs, and risk.
• Experience reviewing third-party AI services, integrations, or connectors, including OAuth and API scope analysis, data-flow mapping, vendor security considerations, token lifecycle, data retention, and training-use terms.
• Working knowledge of secure SDLC and DevSecOps practices, including SAST, SCA, secrets scanning, threat modeling, risk acceptance, and automated deployment gates.
• Experience operating in regulated or high-trust environments such as healthcare, with working knowledge of frameworks such as HIPAA, HITRUST, SOC 2, ISO 27001, GDPR, GovRAMP, FedRAMP, or comparable regional frameworks.
• Ability to communicate clearly with engineers, business builders, product leaders, customer security teams, and compliance stakeholders, including the ability to explain tradeoffs and provide an actionable secure path forward.
• Ability to work US Eastern Time (ET) hours, with core hours of 9:00 AM to 5:00 PM ET, Monday through Friday, regardless of where you are located.
• Bachelor's Degree in Computer Science, Computer Engineering, Cybersecurity, or a related field required.

What we'd like to see, but not required

• Experience building AI agents, RAG applications, MCP servers, model gateways, evaluation harnesses, or other AI platform capabilities.
• Experience with Databricks and Mosaic AI Gateway.
• Experience with Snowflake, vector databases, or large-scale healthcare data platforms.
• Experience with Claude, Azure OpenAI, OpenAI, Gemini, or equivalent enterprise AI services.
• Familiarity with FHIR and healthcare data.
• Experience administering or securing Replit Enterprise or similar AI-assisted and citizen development platforms.
• Experience supporting customer-facing solution architecture, forward-deployed engineering, or technical consulting engagements.
• Prior experience as a technical lead, security architect, application security engineer, or senior engineering resource.
• Experience operating Neo4j Enterprise (clustering, RBAC, online backup) or Amazon Neptune and openCypher workloads.
• Experience with Amazon Bedrock and Titan embeddings, or comparable managed embedding services.
• Experience with Kubernetes (EKS) and GitOps, including external secrets management and agent deployments, and with network detection tooling such as Suricata.
• Experience building knowledge management, enterprise search, or knowledge graph platforms, and with secrets scanning tools such as gitleaks.

What You’ll Get in Return

• Competitive leave and benefits
• Comprehensive health coverage
• Equity for every employee – share in our success
• Growth-focused environment – your development matters here

Work Arrangements

• Standard hours: 9 hours/day, 5 days/week
• Location: Remote; must be able to work U.S. hours (Eastern Time)
• Shift: This role requires alignment with U.S. business hours (Eastern Time) to support the Growth Analytics and Sales leadership teams in real time. Specific working hours may vary based on business needs.