Want to know if this job is worth applying to?
United States
Remote only
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Cyber Engineer based in the United States.
The Senior Cyber Engineer will design, implement, and operate advanced security controls to protect enterprise AI applications, infrastructure, networks, and sensitive member data. This hands-on role focuses on securing emerging generative AI technologies, including large language models, AI agents, and Model Context Protocol (MCP) servers, while strengthening core security platforms. You will take technical ownership of Cloudflare and Palo Alto Networks environments, developing protections against prompt injection, data leakage, unauthorized access, and automated abuse. Working closely with Application Security, Architecture, Data, Privacy, and Compliance teams, you will translate security requirements into practical, enforceable controls. You will also contribute to detection engineering, incident response, automation, and continuous security improvement. This is a remote opportunity for an experienced security engineer who enjoys solving complex challenges and building production-ready defenses in an evolving technology environment.
In this role, you will lead the engineering and operation of AI security controls while maintaining enterprise-grade network and edge protection. You will be accountable for deploying reliable solutions, improving security visibility, and ensuring that controls perform effectively in production. Your responsibilities will include:
AI Application Discovery and Governance: Build visibility into enterprise AI applications, coding assistants, agents, and MCP servers, including unsanctioned tools. Establish risk-based policies to allow, monitor, isolate, or block their use.
AI Data Protection: Design and optimize data loss prevention (DLP) controls for prompts, file uploads, model responses, and agent tool calls, protecting protected health information (PHI), personally identifiable information (PII), and financial data.
AI Runtime Security: Deploy protections for production AI applications and agents, including prompt injection and jailbreak detection, sensitive data identification, topic and output controls, token-based rate limiting, and secure audit logging.
AI Agent Access Management: Define authentication requirements and access permissions for AI agents interacting with internal systems. Ensure tool calls are logged and attributable to the relevant person or service, govern approved MCP connections, and block unauthorized access paths.
AI Gateway Management: Centralize traffic to large language model providers through managed AI gateways, enforcing security policies and providing usage, cost, and credential visibility. Ensure API keys are securely stored in secrets vaults rather than source code, configuration files, or pipelines.
Bot and Agent Protection: Collaborate with Product and Fraud Prevention teams to define how member-facing and employer-facing websites and APIs handle AI crawlers and agents, implementing appropriate controls through Cloudflare Bot Management.
Adversarial Testing: Conduct security testing against AI applications and agents, focusing on prompt injection, data exfiltration, tool misuse, and privilege abuse. Translate findings into stronger controls and detection capabilities.
Secure Architecture Collaboration: Partner with Application Security, Architecture, Data, Privacy, and Compliance teams to assess proposed AI use cases, develop secure reference architectures, and implement enforceable security requirements.
Cloudflare Platform Engineering: Own and operate Cloudflare services, including WAF, API Shield, Bot Management, DDoS protection, rate limiting, DNS, TLS, and Cloudflare One capabilities such as Access, Gateway, Tunnel, CASB, DLP, and Browser Isolation.
Application and API Protection: Protect member and employer applications against account takeover, credential stuffing, scraping, and other automated threats.
Infrastructure Automation: Manage Cloudflare configurations as code using Terraform, Git, peer review, and CI/CD pipelines. Develop custom controls using Cloudflare Workers when native capabilities are insufficient.
Palo Alto Networks Engineering: Operate next-generation firewalls across hardware, VM-Series, and Cloud NGFW environments, as well as Panorama, Strata Cloud Manager, Prisma Access, and GlobalProtect.
Network Security Policy Management: Design and maintain network segmentation, App-ID and User-ID policies, decryption rules, and security profiles covering Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Advanced DNS Security, and Enterprise DLP.
Firewall Lifecycle and Optimization: Maintain policy hygiene by identifying unused, shadowed, and overly broad rules. Manage PAN-OS upgrades, high availability, and timely responses to vendor security advisories.
Security Automation: Automate Palo Alto Networks operations through PAN-OS and Strata Cloud Manager APIs, Terraform, Ansible, and Python.
Detection Engineering: Integrate Cloudflare and Palo Alto Networks telemetry into the SIEM and develop detections for AI-related threats, including prompt injection attempts, sensitive information exposure, and unusual agent behavior.
Incident Response: Serve as an escalation point for incidents involving edge, network, and AI security controls, and participate in the on-call rotation.
Security Performance Monitoring: Track and report control coverage, enforcement rates, false-positive rates, and remediation timelines.
Technical Documentation and Mentoring: Produce design documents, operational runbooks, and security standards; lead design reviews and mentor other engineers.
The ideal candidate will bring extensive security, network, or infrastructure engineering experience, with strong hands-on expertise in enterprise security platforms and emerging AI protection technologies. You should be comfortable designing and operating production controls, automating complex environments, and collaborating with technical and non-technical stakeholders. Required qualifications include:
7+ years of experience in security, network, or infrastructure engineering.
Deep hands-on engineering experience with either Palo Alto Networks or Cloudflare, along with production experience using the other platform.
For Palo Alto Networks: experience with PAN-OS, Panorama or Strata Cloud Manager, and GlobalProtect or Prisma Access.
For Cloudflare: experience with WAF, API Shield, Bot Management, and Cloudflare One.
Practical experience securing generative AI systems, such as governing AI application usage, applying DLP to AI traffic, deploying AI gateways or LLM firewalls, or securing LLM-based applications and agents.
Working knowledge of AI-specific threats, including direct and indirect prompt injection, sensitive information disclosure, excessive agency, and tool misuse.
Familiarity with the OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, and MITRE ATLAS.
Strong networking fundamentals, including TCP/IP, routing and BGP, DNS, TLS and PKI, HTTP, proxies, and IPsec.
Infrastructure-as-code and automation experience using Terraform, Git, CI/CD, and Python.
Experience integrating identity protocols such as SAML, OIDC, OAuth 2.0, and SCIM with enterprise identity providers such as Microsoft Entra ID or Okta.
Experience working in regulated environments that handle sensitive healthcare or financial information, with knowledge of frameworks such as HIPAA, PCI DSS, or SOC 2.
Strong written communication skills, with the ability to explain technical concepts and security requirements to both technical and non-technical audiences.
Nice to have:
Palo Alto Networks Next-Generation Firewall Engineer or Network Security Professional certification; an active PCNSE certification is also welcome.
Hands-on experience with Prisma AIRS, Cloudflare AI Gateway, AI Security for Apps, or MCP server portals.
Development experience with Cloudflare Workers using JavaScript or TypeScript.
Experience building or securing AI agents and MCP servers.
Cloud network security experience across AWS, Microsoft Azure, or Google Cloud.
Detection engineering experience using Cortex XSIAM, Splunk, Microsoft Sentinel, or similar SIEM platforms.
Familiarity with the NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1), or ISO/IEC 42001.
Expected Milestones:
First 90 days: Establish an up-to-date inventory of AI applications, agents, and MCP servers, with policies covering both approved and unsanctioned tools. Deploy AI prompt DLP in monitoring mode against member data patterns and manage Cloudflare configuration as code.
First 6 months: Implement runtime protections and audit logging across all production AI applications. Enable AI DLP enforcement where detection accuracy supports it, deploy AI-related SIEM detections, and integrate Palo Alto Networks changes into the same review and automation pipeline.
First 12 months: Establish an approved reference architecture for AI agents and MCP connections, enforced through Cloudflare and Palo Alto Networks controls. Integrate adversarial testing into AI application releases and achieve a measurable reduction in firewall rule debt.
Salary: Starting annual salary of $120,500, with final compensation determined by relevant knowledge, education, skills, experience, and work location.
Performance Incentives: Eligibility for performance-based incentives as part of the total compensation package.
Healthcare: Medical, dental, and vision coverage.
Health Savings Account: Employer HSA contributions and matching.
Dependent Care: Dependent Care Flexible Spending Account matching.
Paid Time Off: Uncapped paid time off.
Parental Leave: Paid parental leave.
Retirement: 401(k) plan with employer matching contributions.
Financial Wellness: Personal and healthcare financial literacy programs.
Professional Development: Ongoing education opportunities and tuition assistance.
Fitness: Gym and fitness reimbursement.
Wellness: Access to wellness programs and incentives.
Work Arrangement: Fully remote position.
Onboarding: Participation in Trailhead, an immersive in-person onboarding experience held at the organization's headquarters once per quarter. Required travel and accommodation expenses are covered. Initial onboarding may begin virtually before a mandatory onsite session at a later date.