AI Security & DevOps Engineer

📋 Job Overview

We're hiring an AI Security & DevOps Engineer to own how Casper takes AI systems from prototype to production securely. This role will set and enforce the technical standard: threat models, secure defaults, authentication and secrets patterns, CI/CD gates, and the agent-specific controls that AI systems need and traditional security programs don't cover. In parallel, this role will own the client security conversation: engaging their security team early, translating their requirements into what we build, and producing the evidence that gets an enterprise deployment approved.

🏢 About Casper Studios

We’re an AI services firm that helps companies figure out where and how to use AI. We’ve bootstrapped Casper Studios to roughly 40 people, worked with 30+ clients, and done deals with some of the largest companies, PE funds, and model providers. The reason comes down to how we work with clients. Before we build anything, we listen, understand the business, and help them figure out the highest-leverage way to get started on their AI journey.

🎯 The Role

We're hiring an AI Security & DevOps Engineer to own how Casper takes AI systems from prototype to production securely. This role will set and enforce the technical standard: threat models, secure defaults, authentication and secrets patterns, CI/CD gates, and the agent-specific controls that AI systems need and traditional security programs don't cover. In parallel, this role will own the client security conversation: engaging their security team early, translating their requirements into what we build, and producing the evidence that gets an enterprise deployment approved.

✅ Key Responsibilities

• Own Casper's dev-to-production security standard and make it something engineers actually use
• Define and run the security gate in our delivery process: threat models, design reviews, and the call on what ships
• Harden what we build - identity and authentication, secrets management, data protection, egress controls, and the agent surface: prompt injection, tool and connector permissioning, untrusted input in agent loops, MCP auth
• Own the platform work security depends on: CI/CD, automated scanning and review across our repos, infrastructure-as-code, environment and access management, logging and telemetry
• Audit our own repos and internal systems, and fix what you find
• Lead the client security conversation - engage their security team early, extract requirements, map approved and unapproved vendors, and produce the threat models and evidence packs that clear review the first time
• Set our point of view on preferred vendors for auth, secrets, telemetry, and scanning so engagements stop relitigating the same decisions
• Feed security into scoping - realistic timelines and a production roadmap that accounts for how long validation takes
• Raise the security bar across engineering through review, pairing, and written standards

📌 Required Qualifications

• Deep hands-on application and product security experience - you've threat modeled, found real vulnerabilities, and written the fixes yourself
• Real DevOps and platform depth: CI/CD, infrastructure-as-code, cloud (Azure especially, plus AWS/GCP), secrets management, and observability. You've built the pipeline, not just reviewed it
• Identity and authentication depth - OAuth/OIDC, SSO/SCIM, RBAC, conditional access - with working knowledge of Microsoft Entra
• Demonstrated LLM and agent security expertise: prompt injection, excessive agency, tool and connector permissioning, insecure output handling, retrieval abuse, and AI supply chain risk
• Secure SDLC in practice: SAST/DAST/SCA, dependency and supply chain controls, and automated review engineers don't route around
• The judgment to right-size controls to the stage and the stakes
• Client-facing credibility - you can hold a room with an enterprise security team and translate risk into terms an executive can decide on
• AI-native mindset - you use modern AI tooling daily with customized workflows. You can't threat model an agent system you've never built with
• High agency and strong writing. The standards, evidence packs, and memos are yours, and they need to be good enough that busy people act on them

⭐ Desirable Experience

• Regulated-industry exposure - financial services, healthcare, or another environment where security review is genuinely adversarial
• Consulting, agency, or forward-deployed background where you earned trust with a client's security org rather than inherited it
• Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, or ISO 42001
• SOC 2 or ISO 27001 experience - useful context, not the job
• AI red teaming, adversarial testing, or abuse-case analysis

🎁 Benefits

United States USD $150K – $180K Canada CAD CA$180K – CA$230K The posted range represents the typical compensation range for this role. To determine actual compensation we review the market rate of each candidate which can include a variety of factors including qualifications, experience, and location. Additional benefits are shared as part of the job posting.

🛂 Visa & Eligibility

You might be a fit if you've been a first security hire and built the function from nothing, or if you're an AppSec or platform engineer who went deep on LLM and agent security and now gets pulled into every AI review.