Staff Security Engineer, AI

The role

You will build the secure foundation for AI at Compa by designing and implementing architecture across identity, data, endpoint, SaaS, and network. You will secure non-human identities, control data paths, and evaluate attack paths for models and agents.

What you will do

• Build the secure foundation for AI at Compa.
• Design and implement architecture for AI tools and agents across identity, data, endpoint, SaaS, and network.
• Help every team get on approved AI tools quickly.
• Turn ambiguous asks into clear requirements, design, implement, and support solutions in production.
• Secure non-human identities and agent access using scoped credentials and least privilege.
• Govern how internal data reaches models and agents through classification and egress controls.
• Assess third-party models and AI vendors for security and data retention.
• Map attack paths for new models, agents, and integrations.
• Build for detection and response by producing audit logs and automating enforcement.
• Contribute to multidisciplinary security initiatives across identity, endpoint, SaaS, cloud, network, detection, and incident response.

Required qualifications

• Significant hands-on security engineering experience with strong fundamentals and a security and privacy-first approach.
• Experience designing, building, or securing AI systems or integrations, such as agents and tool use, retrieval over internal data, or MCP.
• Working understanding of how AI systems are attacked, including prompt injection, data leakage, and excessive agency.
• Deep experience with identity and access architecture: SSO and federation (SAML, OIDC), conditional access and MFA, privileged access, identity lifecycle, non-human identities, and OAuth consent and s
• Hands-on experience securing endpoints and SaaS, including device management, device posture, SaaS admin controls, third-party integrations, and audit logging.
• Strong cloud and network security fundamentals, such as cloud IAM, segmentation, and egress control.
• A working understanding of adversary TTPs and attack paths across identity, endpoint, cloud, and SaaS.
• Demonstrated staff-level judgment: reasoning from requirements to architecture before tools, turning novel problems into concrete plans, and explaining trade-offs and residual risk.

Nice to have

• Hands-on experience deploying AI security controls such as MCP gateways, LLM proxies, or sandboxed agent execution.
• A background in threat hunting, incident response, detection engineering, or offensive or purple team work.
• Familiarity with AI risk frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, or NIST AI RMF.
• Experience in regulated or high-trust environments, or with privacy and data protection programs.
• Experience building enterprise security architecture at a growing company.

Benefits

• medical
• dental
• vision
• PTO
• parental leave
• equity
• company offsites
• continuous education
• commuter benefits
• flexible work environment

About the company

Compa is a venture-backed AI startup providing a live compensation data platform to enterprise teams. Their products are used by companies including NVIDIA, Stripe, DoorDash, OpenAI, Moderna, Workday, Ulta, and Target.