Note: The job is a remote job and is open to candidates in USA. Casper Studios is an AI services firm that helps companies determine where and how to use AI. The AI Security & DevOps Engineer will own the secure transition of AI systems from prototype to production, defining security standards, platform controls, and delivery gates. The role also leads client security engagements and produces the threat models and evidence required for enterprise deployment approval.
Responsibilities
- Own Casper's dev-to-production security standard and make it something engineers actually use
- Define and run the security gate in our delivery process: threat models, design reviews, and the call on what ships
- Harden what we build - identity and authentication, secrets management, data protection, egress controls, and the agent surface: prompt injection, tool and connector permissioning, untrusted input in agent loops, MCP auth
- Own the platform work security depends on: CI/CD, automated scanning and review across our repos, infrastructure-as-code, environment and access management, logging and telemetry
- Audit our own repos and internal systems, and fix what you find
- Lead the client security conversation - engage their security team early, extract requirements, map approved and unapproved vendors, and produce the threat models and evidence packs that clear review the first time
- Set our point of view on preferred vendors for auth, secrets, telemetry, and scanning so engagements stop relitigating the same decisions
- Feed security into scoping - realistic timelines and a production roadmap that accounts for how long validation takes
- Raise the security bar across engineering through review, pairing, and written standards
Skills
- • Deep hands-on application and product security experience - you've threat modeled, found real vulnerabilities, and written the fixes yourself
- • Real DevOps and platform depth: CI/CD, infrastructure-as-code, cloud (Azure especially, plus AWS/GCP), secrets management, and observability. You've built the pipeline, not just reviewed it
- • Identity and authentication depth - OAuth/OIDC, SSO/SCIM, RBAC, conditional access - with working knowledge of Microsoft Entra
- • Demonstrated LLM and agent security expertise: prompt injection, excessive agency, tool and connector permissioning, insecure output handling, retrieval abuse, and AI supply chain risk
- • Secure SDLC in practice: SAST/DAST/SCA, dependency and supply chain controls, and automated review engineers don't route around
- • The judgment to right-size controls to the stage and the stakes
- • Client-facing credibility - you can hold a room with an enterprise security team and translate risk into terms an executive can decide on
- • AI-native mindset - you use modern AI tooling daily with customized workflows. You can't threat model an agent system you've never built with
- • High agency and strong writing. The standards, evidence packs, and memos are yours, and they need to be good enough that busy people act on them
- • Fully remote, US/Canada based, with occasional client travel. We have team members across North America and internationally, mostly overlapping North American time zones. Work when and where you want, as long as the work gets done
- • You've been a first security hire and built the function from nothing
- • You're an AppSec or platform engineer who went deep on LLM and agent security and now gets pulled into every AI review
- • You've been the security lead on client-facing delivery and know how to get a skeptical enterprise security team to yes
- • You've owned production readiness for systems that had to clear a real audit
- • You want standard-setting authority and are comfortable being the only person in the company who does what you do
- • Regulated-industry exposure - financial services, healthcare, or another environment where security review is genuinely adversarial
- • Consulting, agency, or forward-deployed background where you earned trust with a client's security org rather than inherited it
- • Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, or ISO 42001
- • SOC 2 or ISO 27001 experience - useful context, not the job
- • AI red teaming, adversarial testing, or abuse-case analysis
Benefits
- Medical, Dental, and Vision Coverage: Comprehensive health benefits to keep you and your family healthy.
- Flexible PTO: Take the time you need to relax and rejuvenate.
- Health FSA/HSA: Manage out-of-pocket health expenses effectively.
- Life Insurance: Providing peace of mind for you and your loved ones.
- Fully remote work arrangement for US/Canada-based employees.
- Work when and where you want, as long as the work gets done.
Company Overview