AI Investigations & Enforcement Analyst

Overview

Vanguard is seeking an experienced security practitioner to investigate AI-related security events and execute approved enforcement actions across enterprise AI use cases, supporting a 24/7 operational security function.

What you'll do

• Triage and investigate alerts involving enterprise AI applications, LLMs, AI agents, plugins, skills, browser extensions, local IDE tooling, agent-to-agent traffic, and SaaS/PaaS attack surfaces.
• Correlate telemetry from endpoint, network, cloud, SaaS/PaaS, identity, AI gateway, and application controls to determine scope, cause, and potential impact.
• Execute documented enforcement actions such as blocking prohibited AI destinations or tools, restricting risky agent capabilities, escalating compromised identities, and recommending policy changes.
• Validate detections and enforcement policies through controlled sandbox and adversarial testing, including prompt injection, impersonation, data leakage, unsafe tool use, and unauthorized model or agent access.
• Maintain investigation records, evidence, indicators, case timelines, and remediation actions in accordance with security operations procedures.
• Partner with SOC, incident response, identity, endpoint, network, cloud, application security, and AI platform teams to resolve AI security findings.
• Identify recurring investigation patterns and recommend detection logic, runbook, dashboard, or policy improvements.

What you'll need

• Minimum 5 years of experience in cyber threat detection, incident response, or security operations with exposure to real-time threat analysis and response strategies.
• Bachelor's degree (B.E./B.Tech) in Computer Science, Cybersecurity, Information Technology or a related discipline, or a Master's degree/Diploma in Cybersecurity or Network Security.
• Experience in cybersecurity, security operations, incident response, threat analysis, application security, cloud security, or a related discipline, including hands-on experience investigating or securing workloads in public cloud environments.
• Working knowledge of LLM and agent security concepts, including prompt injection, sensitive data exposure, excessive agency, tool abuse, insecure plugins, and machine/non-human identity risk.
• Knowledge of AI supply chain and security posture management concepts, including MCP servers, agent skills, plugins, model and prompt artifacts, AI-generated code, and other AI artifacts.
• Hands-on ability to analyze logs, alerts, HTTP/API traffic, endpoint telemetry, authentication activity, and network events.
• Experience with security technologies such as SIEM, EDR, SSE/SWG, API security, cloud security, identity controls, or AI gateways.
• Ability to document investigations clearly and communicate technical findings to engineering and security partners.

Details

• Location: Hyderabad, Telangana at Vanguard India.
• Only qualified external applicants will be considered.
• Hybrid working model for most employees.