Staff Security Engineer [Remote-US]

To help keep everyone safe, we encourage all applicants to pay close attention to protect themselves during their job search. When applying for a position online you are at risk of being targeted by malicious actors looking for personal data. Please be aware we will only reach out via email using the domain quanata.com. Anything that does not match those domains should be ignored and considered a security risk.

About Us

Quanata is on a mission to help ensure a better world through context-based insurance solutions. We are an exceptional, customer centered team with a passion for creating innovative technologies, digital products, and brands. We blend some of the best Silicon Valley talent and cutting-edge thinking with the long-term backing of leading insurer, State Farm.

Learn more about us and our work at quanata.com

Our Team

Quanata, LLC is an insurance technology innovation company that engineers advanced risk prediction and prevention solutions, develops risk-focused acquisition capabilities, and builds/supports a full-stack, flexible, digital & increasingly AI-native insurance platform. This helps our primary clients, State Farm and HiRoad Assurance Company, adapt to evolving market needs. Quanata, LLC is wholly owned and funded by State Farm.

As a company that prioritizes an inclusive and positive culture, we believe the core of our success is in hiring talented people — across disciplines — who want to help us make a quantifiable impact.

The Role

As a Staff Security Engineer, you’ll play a key role in securing the AI-enabled systems, applications, and platforms that power our organization. You’ll partner closely with engineering, product, infrastructure, and security teams to make security an integral part of how AI solutions are designed, built, deployed, and operated.

This is a hands-on technical leadership role for someone who is equally comfortable diving into architecture and threat models, evaluating emerging AI risks, and translating security requirements into practical engineering solutions. You’ll help secure everything from LLM applications and RAG pipelines to agentic AI workflows, third-party integrations, CI/CD pipelines, and AWS-native infrastructure.

Your impact will extend beyond AI. As a senior individual contributor, you’ll help shape our broader security strategy, establish scalable security patterns and standards, and influence technical decisions across the organization. You’ll have the autonomy to tackle complex security challenges and drive initiatives from strategy through implementation.

Your Day-to-Day

Partner with engineering and product teams to embed security into AI-enabled products, internal applications, APIs, services, and platforms throughout their lifecycle.

Lead threat modeling, security architecture reviews, and risk assessments for LLM applications, RAG pipelines, agentic workflows, MCP servers, model providers, third-party AI tools, plugins, automations, and AI-assisted development.

Define and implement secure AI engineering patterns, guardrails, standards, and reference architectures across identity, data protection, prompt and context handling, tool permissions, logging, monitoring, abuse prevention, and incident readiness.

Strengthen AWS-native infrastructure and CI/CD environments, including infrastructure-as-code, containerized workloads, secrets management, workload identity, deployment pipelines, and software supply chain controls.

Partner with security operations, detection engineering, incident response, and vulnerability management teams to improve AI-related detection, observability, telemetry, and response capabilities.

Evaluate AI applications, SaaS platforms, model providers, MCPs, agents, developer tools, and other third-party technologies for security, privacy, access, data exposure, logging, contractual, and operational risks.

Develop practical security guidance, training, and enablement materials that help engineering and business teams use AI safely and build secure solutions.

Lead cross-functional security-by-design initiatives, translate security objectives into technical requirements, influence architectural decisions, and take ownership of broader security projects and critical incident response efforts as organizational needs evolve.

About You

Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related technical field; an equivalent combination of education and relevant experience; or equivalent relevant experience .

8+ years of experience in full-stack security, product security, application security, cloud security, DevSecOps, infrastructure security, or software engineering with significant security responsibilities.

5+ years of demonstrated experience working with AI, machine learning, LLM, GenAI, or AI-enabled application environments, including hands-on experience securing, assessing, building, integrating, or operating AI-enabled systems.

Proven experience conducting security architecture reviews, threat modeling, secure design reviews, code or configuration reviews, and risk assessments for modern applications, APIs, platforms, and distributed systems.

Experience evaluating and securing third-party SaaS platforms, AI tools, model providers, developer tools, APIs, integrations, and vendor-managed services.

Experience partnering across security operations, detection engineering, incident response, GRC, privacy, infrastructure, and product engineering teams.

Strong hands-on experience securing cloud-native environments, preferably AWS, including IAM, networking, logging, monitoring, secrets management, workload identity, infrastructure-as-code, and secure deployment practices.

Strong understanding of modern CI/CD pipelines, source control, build systems, artifact management, deployment automation, container security, software delivery workflows, and software supply chain risk.

Working knowledge of AI-specific security risks, including prompt injection, insecure tool use, excessive agency, data leakage, sensitive data exposure, RAG security risks, model and provider trust boundaries, plugin and MCP risks, insecure agent permissions, model extraction, model abuse, and AI supply chain concerns.

Ability to translate AI and cloud security risks into practical engineering requirements, compensating controls, standards, detections, and operational procedures.

Strong written and verbal communication skills, with the ability to explain complex technical risks, document standards, influence decisions, and drive remediation across technical and business teams.

Demonstrated ability to work independently, self-organize, prioritize competing risks, and lead complex cross-functional security initiatives from concept through execution.

Bonus Points

Experience securing agentic AI systems, MCP servers, AI agents, tool-calling or autonomous workflows, internal copilots, LLM gateways, AI assistants, or AI-enabled developer productivity tools.

Experience with AWS AI/ML and GenAI services such as Amazon Bedrock, SageMaker, Comprehend, Transcribe, Textract, or related AWS-native capabilities.

Experience securing RAG architectures, vector databases, embedding pipelines, knowledge retrieval systems, data classification workflows, and sensitive data within AI applications.

Experience implementing AI security guardrails such as model access controls, approved-provider patterns, prompt and context protections, DLP integrations, logging requirements, policy enforcement, and AI usage monitoring.

Experience with detection engineering, SIEM/SOAR platforms, cloud security posture management, vulnerability management, endpoint security, or related security operations tooling.

Experience developing secure software in Python, TypeScript, JavaScript, Go, Java, or similar languages.

Experience with Kubernetes, Docker, Terraform, GitHub Actions, GitLab CI/CD, Jenkins, or simi