Staff Information Security Engineer - AI First

Overview

Rithum™ is the world’s most trusted commerce network, accelerating how brands, suppliers, and retailers work together to deliver seamless e-commerce experiences. More than 40,000 companies trust Rithum to grow their business across hundreds of channels, representing over $50 billion in annual GMV.

Rithum expects employees across all roles to leverage AI and technology to improve efficiency, streamline workflows, and create scalable ways of working. As a Staff AI-First Information Security Engineer, you own the intersection of AI adoption and information security: designing guardrails for AI-powered products, building automated security tooling, designing security controls and monitoring for an AI-First workforce, and helping teams move fast without creating unseen risk.

This role involves turning repeating controls into infrastructure-as-code, manual reviews into workflows, and vague AI risks into concrete, enforced guardrails. You will work autonomously, balancing research with fast-paced delivery, and collaborating closely with Platform Engineering, IT, Security Champions, and external auditors.

Responsibilities

• Act as the bridge between architectural intent and operational reality; mediate conflicts between security requirements and feasible implementation, propose compensating controls where gaps exist, and help register, track, and remediate residual risks.
• Implement preventive, default-on security controls across cloud and enterprise environments codified as policy- and infrastructure-as-code, including controls that govern how AI tools and models may be used.
• Implement and enforce identity and access controls, including access boundaries for AI systems and non-human/agent identities, partnering with Platform Engineering and IT to align tooling and policy.
• Assist in maintaining the InfoSec risk register, tracking emerging threats, and translating them into actionable guidance for engineering teams.
• Support third-party and vendor risk assessments, focusing on vendors processing data through AI pipelines.
• Automate repetitive security workflows (evidence collection, access reviews, alert enrichment) and build or operate AI-assisted security agents with human-in-the-loop approval gates, least-privilege credentials, and controlled blast radiuses.
• Integrate security tooling (SIEM, CSPM, DAST/SAST, vulnerability scanners) with LLM layers to surface actionable insights and automated responses.
• Define and enforce security requirements for AI-powered features: model access controls, prompt-injection mitigations, output validation, and data-handling boundaries.
• Conduct threat modeling on agentic and LLM-based systems, accounting for attack surfaces such as tool misuse, indirect prompt injection, and supply chain risk.

Qualifications

Minimum Qualifications

• 5+ years of security engineering experience with demonstrated AI/ML security depth (prompt injection, model supply chain, adversarial inputs, RAG).
• Experience using AI tools (ChatGPT, Copilot, Claude, etc.) and LLM frameworks and APIs (OpenAI, Anthropic, LangChain, or similar) to accelerate your work.
• Hands-on identity and access expertise across modern enterprise and cloud identity stacks, including access models for AI systems and non-human identities.
• Proficiency with infrastructure and policy-as-code (e.g., Terraform, OPA/Rego) and a scripting language for automation (Python preferred).
• Cloud security expertise: AWS Solutions Architect / Security Specialty or equivalent demonstrated expertise, including multi-account governance, preventive guardrails, and policy-as-code.
• Application security background (OWASP Top 10, OWASP LLM/GenAI Top 10, secure SDLC) and threat-modeling methodologies (STRIDE, PASTA, or equivalent).
• Practical experience building or operating AI agents and integrating security tooling (SIEM, CSPM, SAST/DAST/SCA) to surface actionable outcomes.
• Working knowledge of SOC 2 and/or ISO 27001 control frameworks.

Preferred Qualifications

• Experience building or operating AI agents in a production environment.
• Awareness of privacy regulations (GDPR/CCPA) impacting AI, including privacy-by-design and DPIAs.
• Background in red teaming or adversarial ML research.
• Experience implementing privileged-access, key-management, posture-management, or data-protection programs.
• Experience with EDR, CASB, DLP, security automation, and SAST/DAST/IAST/SCA tools.
• Cloud Architecture or Security certifications (CCSK, TAISE, AWS).

Travel

• Up to 10% travel required.