Principle Security Engineer

Cetera Financial Group is seeking a Principle Security Engineer focused on AI risk, governance, and compliance within a regulated financial services environment. In this onsite Oregon role, you will operationalize AI governance controls, strengthen AI third-party/vendor oversight, and lead adversarial threat modeling for AI and ML systems using MITRE ATLAS.

You will help ensure AI development and deployment practices produce audit-ready evidence and align with recognized AI risk management expectations, while partnering across IT Risk, Cloud Security, Legal, Procurement, and Application/AI Engineering.

Responsibilities

• Operationalize AI governance controls: Implement and maintain controls aligned to recognized AI risk management frameworks, including governance, mapping, measurement, and management of AI risk. Produce control documentation, maintain risk-control matrices (RCM), and collect evidence to support audits and regulatory exams.
• Lead AI third-party risk management: Evaluate and onboard third-party AI/ML tools and vendors against security, privacy, and compliance criteria. Document AI-specific vendor and contract requirements, SLAs, and fourth-party disclosures, and support due diligence and data provenance reviews.
• Maintain AI/vendor risk inventories: Build and maintain documentation of third-party AI components, including models, datasets, APIs, and pre-trained or foundation models. Cover provenance, functionality, and known limitations, and map internal controls to those components.
• Run ongoing AI risk assessments: Conduct recurring assessments covering AI system performance, data quality, algorithmic bias, and security controls. Monitor pre-trained or foundation model drift and SLA adherence, and assess concentration and dependency risk across AI vendors.
• Perform AI threat modeling: Design and execute threat models for AI/ML systems using MITRE ATLAS, identifying adversarial tactics and techniques across the AI development and deployment lifecycle, including prompt injection, data or model poisoning, model evasion, model extraction, and supply-chain risk in ML pipelines.
• Coordinate adversarial testing: Plan and coordinate red-teaming, adversarial testing, and penetration testing of AI/ML systems, and maintain ongoing threat assessments informed by current threat intelligence and prior incidents.
• Integrate AI into vulnerability management: Ensure AI-specific vulnerabilities and security findings are captured, prioritized, and remediated through existing enterprise vulnerability management processes.
• Identify and assess unsanctioned AI usage: Support discovery and risk assessment of unsanctioned (shadow) AI tool usage across the enterprise and recommend remediation or approval pathways.
• Partner cross-functionally: Collaborate with IT Risk, Cloud Security, Legal, Procurement, and Application/AI Engineering to embed AI risk and compliance requirements into intake, procurement, and development workflows.
• Support governance and audit activities: Develop and maintain AI risk standards, control narratives, and runbooks. Support internal and external audits and regulatory compliance activities (including FINRA) by producing control evidence tied to the organization’s AI risk management framework.

Requirements

• 10+ years of experience in IT/cyber risk, GRC, security engineering, or a related discipline, with direct exposure to AI/ML systems.
• Working knowledge of AI risk and control frameworks (for example, NIST AI RMF or similar) and OWASP Top 10 for LLMs.
• Practical experience with threat modeling methodologies for AI/ML systems, including familiarity with MITRE ATT&CK and MITRE ATLAS.
• Experience building or operating third-party/vendor risk management processes, including due diligence, contracting/SLAs, ongoing monitoring, and issue remediation.
• Understanding of AI-specific attack techniques (prompt injection, data/model poisoning, model evasion, model extraction/inversion) and associated mitigations.
• Ability to translate technical risk findings into control objectives, policy language, and audit-ready documentation.
• Experience in regulated environments (financial services or FINRA preferred).
• Strong communication skills across technical, risk, legal, and compliance stakeholders.

Technologies

• MITRE ATLAS
• MITRE ATT&CK
• NIST AI RMF
• OWASP Top 10 for LLMs
• FINRA
• Archer
• ServiceNow GRC
• CRISC
• CISSP
• CCSP
• IAPP AIGP
• AWS Bedrock
• Red team, purple team
• Penetration testing
• GRC platforms
• Model cards
• Data lineage/provenance tooling
• AI bill-of-materials (AI-BOM)

Benefits

• Inclusive health, dental, vision, and life insurance plans
• Easy access to mental health benefits
• 20+ days of paid time off (PTO), paid holidays, and 2 paid wellness days
• 401(k) savings plan with a generous company contribution (up to 5%)
• Paid parental leave to support all team members with birth, adoption, and fostering
• Health Savings and Flexible Spending Account options
• Employee Assistance Program (EAP), LifeLock, Pet Insurance and more
• Paid caregiver leave to provide time away from work when caring for an ill or recovering family member
• Additional benefits such as an Employee Assistance Program (EAP), identity theft protection (LifeLock), pet insurance, and other voluntary benefits