Applied AI Security Engineer, Waabi

• Bachelor's degree in Computer Science or a related field
• Professional software development experience, with solid fundamentals in how services, APIs, and permissions fit together
• Hands-on experience using AI coding/productivity tools (Claude, Copilot, Gemini, or similar) in business-critical workflows
• Working knowledge of core security concepts — least privilege, sandboxing, trust boundaries, threat modeling basics
• Strong communication skills - you work with engineers as a partner

Desirable

• Waabi is leaning into an AI-native strategy — not just in our trucks, but in how we build, ship, and operate every day
• Our teams leverage key AI tools to enhance productivity and efficiency, continuously expanding AI integration across our systems and workflows. That's a huge unlock, and it's moving fast. We're looking for someone to make sure it keeps moving fast safely — by establishing the guardrails and collaborating on the implementation of sandboxes and automations that let people adopt AI with confidence instead of second-guessing themselves
• You'll join a small, sharp security team and take primary ownership of AI security controls and considerations across the company. If you've got a developer's instincts, a security mindset, and you're genuinely curious about what these tools can and can't be trusted to do, this role is built around you
• Audit how AI tools and MCP integrations are currently used across the company, and map where they touch sensitive systems, data, or credentials for the purpose of defining policy
• Design and implement layered guardrails - enterprise-level system prompts, scoped permissions, sandboxing patterns - that constrain AI behavior before it ever reaches a user's request
• Maintain an inventory of both MCP servers and AI-to-service connections and their data access controls, with a clear model of what each one can access and why
• Partner directly with users across the organization to bake secure-by-default patterns into their AI-assisted workflows so that written policy doesn’t just sit on a shelf
• Evaluate new AI tools, plugins, and integration requests, and figure out the secure way to say yes
• Continuously test and red-team your own guardrails - assume they'll be pushed on, and find the gaps before someone else does
• Document guidance and patterns that a non-security audience can actually follow without needing a security background