About Alvarez & Marsal
Alvarez & Marsal (A&M) is a global consulting firm with entrepreneurial, action and results-oriented professionals. We take a hands-on approach to solving our clients' problems and assisting them in reaching their potential. Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry. The collaborative environment and engaging work—guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity—are why our people love working at A&M.
The Team
This role sits at the intersection of security engineering, cloud security, and AI governance, and will work closely with the wider Global Security Office, GRC, Legal, and business technology teams.
The primary focus is on owning and operating AI security controls within SecEng's scope, contributing AI security input into cross-functional programmes, and building out the firm's AI security capability in a nascent but high-priority space.
How you will contribute
The Security Engineer (AI) is a hands-on technical role focused on the security and governance of A&M's enterprise AI platforms. The following are the specific outcomes this role is expected to own within SecEng:
AI Platform Security
Lead the security assessment, onboarding, and hardening of A&M's enterprise AI platform deployments, defining and implementing controls spanning data governance, access management, audit logging, DLP integration, and network security across all environments.
Act as the SecEng subject matter expert for AI security and governance controls, including tooling such as Harmonic, and take ownership of securing enterprise AI applications (e.g. Claude, Claude Code, Claude Cowork).
Build and operationalise a continuous AI security monitoring capability within SecEng, including detection logic for anomalous usage patterns, data leakage indicators, and policy violations within A&M's deployed AI tools.
Integrate AI security considerations into SecEng's broader engineering roadmap, including vulnerability management and cloud security posture management.
Serve as the primary technical liaison with AI platform vendors' security team, maintaining awareness of vendor updates, new capabilities, and security advisories that may affect A&M's deployments.
Threat Modelling and Risk
Develop and maintain the technical AI security threat model for A&M, identifying attack surfaces unique to LLM-based platforms and mapping technical mitigating controls to each risk scenario. This work is expected to be conducted in collaboration with the SOC/Threat Intelligence, GRC, and Legal/Privacy functions, each of whom contribute to the broader AI risk picture.
Apply knowledge of Secure Software Development Lifecycle (S-SDLC) and IDE security to assess risks introduced by AI-assisted coding tools and developer workflows, partnering with digital and technology teams across A&M's business units who are actively building AI-integrated solutions.
Cross-Functional Contributions
The role will contribute SecEng's technical expertise into the following cross-functional programmes, where ownership of outcomes rests with the relevant function:
Support GRC in developing and maintaining an AI Risk Register by providing technical risk input, control mapping, and evidence - GRC owns the register as a governance deliverable.
Contribute AI-specific platform controls, logging, and containment options to Incident Response's AI security playbooks - IR owns the playbook and response process.
Work with the Security Awareness team to develop technically accurate training content on the secure and compliant use of A&M's AI platforms.
Engage with Legal, Privacy, and Compliance stakeholders to provide technical input into A&M's AI governance obligations under GDPR, client contractual requirements, and applicable data sovereignty regulations.
Contribute the SecEng perspective into cross-functional AI governance working groups, supporting strategic decisions on AI tool adoption, expansion, and policy evolution.
Participate in A&M's Security Assurance Review (SAR) process, providing technical security input into AI-driven development and tooling assessments.
Qualifications
You will currently be a security / cloud security engineer (ideally Azure) with minimum 4 years experience in this role and at least 3 years specifically in AI/LLM security where the candidate has owned assessments, not just contributed to them. You will have demonstrable hands-on familiarity with AI-specific threat scenarios (prompt injection, data exfiltration via model outputs, training data poisoning, adversarial inputs) from a technical control perspective, not just a governance/policy one.We also require relevant professional certification (CISSP, CISM, CCSP, CEH, OSCP, or AZ-500) or clear progress towards one, plus ideally exposure to AI governance frameworks (ISO 42001, EU AI Act, NIST AI RMF) as a bonus rather than the core skillset.
Essential
A minimum of 3 years’ experience in AI security, with demonstrable expertise in serving as the subject matter expert for AI security and governance controls.
A minimum of 4-years of progressive experience in cybersecurity, with a strong security engineering or cloud security foundation.
Demonstrable interest in or exposure to AI/ML security, LLM security, or the security of intelligent systems.
Hands-on experience securing enterprise SaaS platforms, with experience or strong interest in AI-powered productivity tools or LLM deployments.
Prior involvement in AI security assessments, AI governance programmes, or vendor security evaluations for AI platforms.
Cloud and platform security: proficiency in cloud security across Microsoft Azure, including cloud-native security controls, CSPM tooling, and secure API gateway configuration, with familiarity in API security principles for hardening integrations between enterprise systems and third-party AI providers.
Understanding of enterprise identity and access management (IAM), including zero-trust architectures, role-based access control (RBAC), and privileged access management (PAM).
Familiarity with AI-specific threat scenarios such as prompt injection, data exfiltration via model outputs, training data poisoning, and adversarial inputs.
Data classification and handling: experience with data classification frameworks and the application of data handling policies within AI tools to prevent sensitive information from being exposed or retained inappropriately.
Bachelor's degree in Computer Science, Information Security, Cybersecurity, Engineering, or a closely related technical discipline. Equivalent professional experience will be considered.
A relevant professional certification in cybersecurity, such as one of: CISSP, CISM, CCSP, CEH, OSCP, AZ-500, or an equivalent qualification appropriate to the candidate's experience level. Candidates actively working towards certification will also be considered.
Desirable
Experience working within professional services, financial services, consulting, or similarly regulated industries.
Experience contributing to enterprise security assurance programmes or red team exercises, including in AI/ML contexts.
Regulatory and standards knowledge: familiarity with relevant regulatory frameworks and standards including ISO 42001, ISO 27001, SOC 2, GDPR, NIST AI RMF, and the EU AI Act as they pertain to enterprise AI deployments.
Scripting and automation: scripting or programming skills (Python, PowerShell, or similar) sufficient to automate security workflows, write detection rules, and analyse telemetry from AI platform usage.
Security monitoring tooling: working knowledge of SIEM platforms, DLP solutions, CASB tooling, and endpoint detection technologies as they relate to AI usage monitoring.
Secure development practices: knowledge of Secure Software Development Lifecycle (S-SDLC) principles and IDE security controls, including the assessment of AI-powered coding assistants and their potential to introduce risk into software development workflows.
Postgraduate degree (MSc or equivalent) in Cybersecurity, AI, Data Science, or a related field.
Certification or demonstrated expertise in AI or machine learning security, such as those offered by GIAC (e.g. GAISC), or completion of recognised AI security training programmes from MITRE, NIST, or equivalent bodies.
Certification in cloud security, such as Microsoft Certified: Azure Security Engineer Associate (AZ-500) or Microsoft Cybersecurity Architect Expert (SC-100).
Completion of enterprise AI administrator or security training from one or more major AI platform vendors (such as Microsoft, Google, Anthropic, or OpenAI) or equivalent vendor-accredited security education.
Personal Competencies:
The successful candidate will be a technically curious, pragmatic security professional who is comfortable building frameworks and controls in a nascent, ambiguous discipline; who communicates and collaborates confidently across all levels of the organisation; who upholds the highest standards of integrity, discretion, and ethical AI practice; and who brings the resilience, organisation, attention to detail, and proactive ownership needed to manage multiple concurrent priorities in a fast-moving global environment.
Your journey at A&M
