AI Security Engineer

The AI Security Engineer is a technical and consulting role focused on the design, development and production deployment of AI systems, both for client engagements and to support the organization's internal needs. The role complements the AI Security Advisor: where the latter drives strategy, governance and advisory, the AI Security Engineer focuses on execution. They build, ship and maintain the solutions, with clients and internally, embedding security best practices from design onward.

The role combines a strong appetite for software engineering with curiosity for applied AI (LLMs, agents, RAG, MLOps) and the associated security challenges. A significant share of the activity is dedicated to client engagements: requirements gathering, design, prototyping, development, support to production rollout, and knowledge transfer. In parallel, the AI Security Engineer contributes to the organization's strategic internal initiatives (AI-enabled business tools, agentic automations for security, transverse RAG platforms), which also serve as a learning ground and as a basis for capitalizing on client engagements.

Direct report: AI Security Advisor / Senior Management

Tasks and Responsibilities

Client engagements and consulting

• Deliver on client projects that require software engineering and the secure integration of AI components, with a level of autonomy adapted to the profile and to the engagement context.

• Take part in scoping workshops with clients: understanding the business need, translating it into a technical architecture, identifying security and compliance constraints.

• Design, prototype and develop the solutions delivered to clients: LLM integrations, RAG, agents, AI-driven automations, within the framework set by the AI Security Advisor.

• Support the client through to production: industrialization, secure deployment pipelines, knowledge transfer to the client's internal teams.

• Contribute to pre-sales activities: demos, PoCs, technical estimates, technical sections of RFP responses, alongside the sales teams and the AI Security Advisor.

• Represent the organization in front of clients with a strong level of communication, pedagogy and consulting posture.

• Capitalize after each engagement: lessons learned, reusable components, contributions to internal frameworks and standards.

Development and industrialization of internal AI tools

• AI-enabled business tools : actively contribute to the development and evolution of internal solutions (for example in CRM, due diligence or decision support domains), embedding software quality and security best practices.

• Document processing pipelines : contribute to the development and maintenance of automated document processing tools, ensuring pipeline robustness and the protection of the data being handled.

• Agentic automations for security : develop agentic components for cybersecurity operations (notably SOC use cases), in close collaboration with the Cyber Defense teams and the AI Security Advisor.

• Design and develop internal tools based on RAG, agents and AI-driven automations to support the needs of IT, HR and other departments.

• Industrialize PoCs and PoVs produced by the AI team into robust, maintainable solutions.

• Document, test and maintain the delivered solutions over time.

Embedding security in AI development

• Apply secure coding and application security best practices in the code produced, both internally and for clients.

• Secure AI deployment pipelines: CI/CD, secrets management, dependency control, API and cloud integrations.

• Implement defense mechanisms suited to AI systems: guardrails, input and output filtering, monitoring, control over the tools accessible to agents.

• Contribute, with the AI Security Advisor, to the operational implementation of reference frameworks (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF) within projects.

• Take part in threat modeling and code review activities on AI components, in collaboration with the AI Security Advisor.

Watch and capitalization

• Keep up to date on tools, frameworks and best practices for AI development and the associated application security.

• Develop reusable libraries, scripts and components to accelerate future projects.

• Contribute to internal knowledge sharing: lessons learned, demos, documentation.

• Capitalize on project insights to feed the standards and frameworks driven by the AI Security Advisor.

Collaboration and communication

• Work closely with the AI Security Advisor to ensure alignment between strategy and execution.

• Collaborate with delivery and R&D teams.

• Communicate effectively with technical stakeholders (dev, DevSecOps, MLOps) as well as non-technical ones (business, management).

• Contribute to coordination with Thales global initiatives around AI.

Skills

Expected technical foundation

• Solid software engineering fundamentals, ideally in Python, with care for clean, tested and maintainable code.

• Curiosity and first hands-on experience with modern AI architectures: LLMs, RAG, agent frameworks, API-based integrations.

• Awareness of application security topics: understanding of common vulnerabilities (OWASP Top 10) and secure coding principles.

• Foundations on at least one cloud platform (AWS, Azure or GCP) and on DevOps practices (CI/CD, containerization, infrastructure as code).

Topics to grow into within the role

• Design and industrialization of production-grade AI solutions: advanced RAG, agents, orchestration, observability.

• AI-specific risks and the associated defense techniques: prompt injection, data poisoning, guardrails, agent sandboxing, tool access control.

• Reference frameworks and standards in the field: OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, AI Act.

• MLOps practices and the securing of AI deployment pipelines.

Mindset and personal qualities

• Genuine passion for AI and cybersecurity, with visible personal practice: side projects, open source contributions, experimentation, blogging, active watch.

• Strong interpersonal skills and a willingness to work directly with clients: listening, rephrasing, simplifying, defending a position on technical grounds.

• Curiosity, autonomy and the ability to learn fast in a field that evolves every week.

• Strong delivery mindset: finish what you start, ship things that work, and iterate.

• Ability to communicate simply, in writing and orally, in French and English, in a professional context and in front of varied audiences (technical and business).

• Eagerness to work in close collaboration with the AI Security Advisor and to grow on AI, security and consulting topics.

Candidate profile

• The position is open to all experience levels, from junior to senior. The scope of engagements, the level of autonomy and the client-facing posture will be calibrated accordingly.

• The common foundation expected is a software engineering background combined with a real appetite for cybersecurity, AI and consulting topics.

• For more junior profiles, demonstrated passion, fast learning ability and the appetite for project-based work matter more than formal experience. For more senior profiles, prior exposure to client environments and to AI or application security projects will be valued.

• Personal projects related to AI, software engineering or application security are a strong plus regardless of experience level.

Required Languages/

• French or Dutch native
• English is a plus

Valued certifications

No certification is required upon hiring. A skills development plan will be set up and may include the GIAC certifications dedicated to AI security, which directly map to the scope of the role:

• GIAC AI Platform Security (GAIPS) : securing GenAI applications and LLM development pipelines (integrations, APIs, MLOps, agents).

• GIAC AI Security Automation Engineer (GASAE) : automation and AI applied to offensive, defensive and cloud security operations, particularly relevant to agentic automations in cybersecurity.

• GIAC Offensive AI Analyst (GOAA) : offensive techniques related to AI (deepfakes, guardrail bypass, AI-assisted malicious code generation), useful to inform defensive practices.

Other cybersecurity or cloud certifications (OSCP, OSCE, AWS/Azure/GCP certifications, etc.) will also be valued.