Principal AI Security Engineer

ServiceNow · petahtikva

Role This is a hands-on architecture role: deep research, secure systems design, and prototyping, applied across product lines with minimal direction and broad latitude to set the technical agenda. You will set platform-wide direction for securing the AI development lifecycle, define the security architecture, agents, and models operating within it, and represent ServiceNow's AI security point of view externally. You'll be a technical authority other engineers and other teams look to on emerging AI-specific threats, working in close partnership with the AI security research team - drawing on their findings and feeding real-world attack surfaces back into their agenda. What you'll do Own the security strategy and architecture for our Agentic AI ecosystem, LLMs, and models across product lines Lead threat modeling for the most complex and novel GenAI/agentic surfaces: cross-agent autonomy, multi-agent tool orchestration, and emerging attack classes not yet standardised in the industry Set the architectural standard for securing model/RAG/data pipelines platform-wide, including access-control and data-boundary models that other teams are expected to build against Define what "secure-by-design" means for agentic systems at ServiceNow, and drive adoption across engineering orgs Represent ServiceNow's AI security posture externally (standards bodies, industry publications, conferences) and internally to executive stakeholders Mentor and technically guide engineers on AI-specific security work To succeed in this role, you’ll need: Bachelor’s / Master's degree or PhD in Computer Science or a related technical field, specialisation in Security or AI/ML or an exceptional, well-evidenced track record substituting for it 10+ years of software engineering experience, including a track record of owning the architecture of complex systems at enterprise scale A track record of setting technical direction beyond your own team - architecture or standards other teams adopted, senior engineers you've levelled up, and comfort operating where the problem isn't yet defined 7+ years in security engineering - network and systems security, security protocols, design reviews, and threat modeling - with a focus on AI-specific work in recent years Multiple demonstrated engagements threat modeling and/or securing LLM, GenAI, or agentic systems, with evidence of platform-level or cross-team impact Personal ownership of prompt injection / jailbreak defense, guardrail architecture, or AI red-teaming programs - ideally having built the program/methodology, not just executed within one Deep, applied experience securing model, RAG, or data pipelines, including having designed the access-control and data-governance model others build against Fluency with the OWASP LLM Top 10 (or equivalent) to the point of extending, critiquing, or contributing to such frameworks - not just applying them Deep hands-on experience with agentic AI frameworks (e.g., LangChain, LangGraph) Clear communication, a collaborative default, and a bias toward learning fast in a field that changes constantly Bonus Strong command of auth protocols (OAuth 2.0, OIDC, PKCE, API Keys) and agentic protocols (MCP, A2A), including having designed identity/consent models for them Built and open-sourced (or productized) security tooling/automation for AI systems now used beyond one team Track record of CVEs, top-tier publications, or invited talks specifically in AI/ML or LLM security Prior experience setting AI security strategy at a platform or company level, not just a single product 5+ years of programming experience in Java or Python

Apply »