SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 131,000 - 170,000 / annual
OneStream is seeking a Senior AI Security Engineer to serve as the senior technical owner for the day-to-day security of the company's internal AI environment. This is a hands-on, high-autonomy role reporting to the AI Security Architect/Manager, responsible for securing enterprise AI assistant platforms, agents, connectors, tool integrations (such as MCP), and AI-enabled business workflows from intake through production.
Key responsibilities include:
- Co-develop and execute the internal AI security roadmap with the AI Security Architect/Manager
- Define and own security review standards for enterprise AI assistant and agent configurations, connectors, and workflows, including tenant-level controls, permissions, data-sharing and retention settings, and custom agents and skills; make independent approval decisions and set secure-by-default baselines
- Architect, implement, and own the AI Detection and Response (AIDR) capability end-to-end: monitor AI usage across the enterprise, detect prompt injection, tool abuse, data exfiltration, and anomalous agent behavior, and integrate alerting and response into Security Operations workflows
- Lead security reviews of new and third-party AI tooling, including AI-enabled SaaS features, connectors, MCP servers, and models, against OneStream security policies
- Serve as the Security team's AI automation champion: identify opportunities to incorporate AI into security operations (alert triage, detection engineering, vulnerability management) and lead the design and delivery of those workflows
- Lead threat modeling of internal AI use cases against AI-specific attack classes (prompt injection, jailbreaks, tool misuse, excessive agency, sensitive data leakage, AI supply-chain risk)
- Define, implement, and own the metrics program for internal AI security; report AI security posture to Security leadership
- Operationalize AI governance by partnering with IT, Legal, Privacy, and business teams to translate AI acceptable use, data classification, and security policies into technical guardrails, secure-by-default patterns, review checklists, and training
- Act as incident lead for security incidents involving internal AI systems: investigate, contain, remediate, and drive lessons learned into controls and detections
- Monitor the emerging AI threat landscape and frontier model capabilities; translate developments into updated controls, detections, and guidance
- Provide technical leadership and mentorship to AI Security team members; raise AI security capability across the broader Security team
The role partners with IT, Legal, Compliance, and business leaders to enable the organization to adopt AI securely.
REQUIREMENTS:
- Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent experience
- 6+ years of experience in security engineering, security operations, application security, or a related security discipline, including military or government cybersecurity roles
- At least 1–2 years of demonstrated hands-on experience securing or building with LLM-based systems, such as enterprise AI assistants, agents, tool-calling and connector integrations, or retrieval-augmented workflows
- Demonstrated track record of owning a security program, capability, or major initiative end-to-end, including setting technical direction and making independent risk decisions
- Working knowledge of AI-specific threats (prompt injection, jailbreaks, tool abuse, data exfiltration through agents) and frameworks such as OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI Risk Management Framework
- Experience reviewing SaaS security posture, identity and access controls, and least-privilege and data-sharing configurations
- Experience conducting third-party and vendor security risk assessments and driving remediation with vendors and internal owners
- Experience with detection engineering, SIEM and log analysis, and building monitoring and alerting for new data sources
- Proficiency in scripting and automation (Python or similar), working with APIs, and integrating tools and platforms
- Strong written and verbal communication skills, with the ability to explain AI risk and trade-offs to technical and non-technical stakeholders, including Security leadership and executives
