AI Security Engineer

Overview

Secure BJAK's AI-enabled products and agent workflows using third-party models, with a focus on customer data shared with model providers, agent permissions, user data isolation, and prompt injection through uploaded documents and other untrusted content.

What you'll do

• Assess customer data sent to third-party model vendors, including minimization, vendor controls, retention, logging, and approved use.
• Design controls limiting AI agent permissions, tools, actions, and system access using least privilege and explicit authorization.
• Implement and test tenant and user data isolation across prompts, conversation history, retrieval, memory, and AI-connected services.
• Threat model and test prompt injection and indirect injection through uploaded documents, retrieved content, links, and other untrusted inputs.
• Partner with Product and Engineering on safe document ingestion, content handling, output validation, and approval for sensitive actions.
• Support SC TRM and BNM RMiT for AI technology risks, including assessments, third-party oversight, control evidence, and remediation.
• Build security tests, monitoring, and response procedures for AI misuse, data exposure, unauthorized actions, and vendor incidents.

What you'll need

• Degree in Computer Science, Cybersecurity, AI, or related field, or equivalent experience.
• 3+ years in application security, product security, security engineering, or AI system security.
• Experience implementing or owning SC TRM and BNM RMiT controls, technology risk, or regulatory control evidence.
• Understanding of third-party LLM integrations, model APIs, agent tools, RAG, and AI application architectures.
• Knowledge of prompt injection, indirect injection, cross-user data leakage, excessive agent permissions, and vendor data disclosure risks.
• Programming or scripting skills, preferably Python and TypeScript/Node.js, plus APIs and AWS or GCP.
• Ability to collaborate with Product, Legal, Compliance, Data, and Engineering on practical controls and risk communication.
• Strong English communication is required.

Details

• Location: China.
• English is the main working language across global teams.