Citizens Financial Group is building secure, responsible paths for AI adoption, and this role helps operationalize AI security and GenAI data protection capabilities for the AI Gateway platform. You will design and run controls that help reduce AI-related data loss risk while supporting real-world usability for business teams.
Work arrangement: Hybrid, 4 days onsite and 1 day remote from one of these hubs: Johnston, RI, Boston, MA, Marlton, NJ, Pittsburgh, PA, Phoenix, AZ, Irving, TX, or Manchester, NH.
Benefits that support your life and wellbeing
- Comprehensive medical, dental and vision coverage
- Retirement benefits
- Maternity/paternity leave
- Flexible work arrangements
- Education reimbursement
- Wellness programs
- Paid time off policy exceeds the mandatory, paid sick or paid time-away policy requirements of every local and state jurisdiction in the United States
What you’ll be responsible for
- Engineer, configure, and support AI Gateway capabilities across evaluation, proof of concept, deployment, policy tuning, operational support, and continuous improvement
- Support phased rollout of AI security controls, moving from monitor mode to warn and coach, then to targeted blocking based on observed AI traffic, risk metrics, and user behavior
- Develop and tune controls for GenAI prompts, file uploads, browser traffic, embedded copilots, sanctioned AI platforms, and unsanctioned AI applications
- Implement inline remediation capabilities such as redaction, quarantine, user coaching, warning, and blocking
- Create instance-aware controls that distinguish corporate versus personal accounts to reduce the likelihood of sensitive data exposure
- Assess security risks tied to AI agents, Model Context Protocol (MCP), non human identities, third-party integrations, APIs, and emerging AI access patterns
- Integrate AI Gateway telemetry and security events with SIEM, SOAR, ITSM, identity platforms, data protection solutions, and evidence repositories
- Develop and maintain AI security policies, detection logic, enforcement rules, exception processes, and technical operating procedures
- Monitor and improve control effectiveness using coverage, policy accuracy, false positive and false negative trends, remediation outcomes, and user experience metrics
- Troubleshoot complex AI security and data protection issues and partner with technology teams to identify practical remediation approaches
- Work with business teams and AI platform owners to deliver coaching and enforcement controls while minimizing unnecessary business disruption
- Stay current on AI security threats, GenAI data loss trends, agentic AI developments, MCP capabilities, and emerging security technologies
- Contribute to security standards, procedures, technical documentation, training materials, and enterprise communications that support secure AI adoption
- Support risk, audit, and regulatory readiness by documenting security controls, policy decisions, exceptions, and enforcement outcomes
What you’ll need
- Bachelor’s degree in Computer Science, Information Security, Information Technology, or related field, or equivalent professional experience
- 5+ years of progressive experience in cybersecurity, information security engineering, or related technical disciplines
- 2+ years of hands-on experience with Data Protection, SSE, SASE, CASB, DLP, AI Security, GenAI Security, or similar inline security technologies
- Hands-on experience implementing, configuring, or supporting enterprise security platforms and controls
- Understanding of GenAI data flows and associated security risks across prompts, uploads, browser traffic, embedded copilots, APIs, AI agents, and third-party integrations
- Experience implementing real-time monitoring and enforcement controls that can coach, redact, quarantine, or block risky data movement
- Working knowledge of SIEM, SOAR, ITSM, identity management, and security orchestration workflows
- Knowledge of identity and access management concepts, including corporate versus personal instances, least privilege, non human identities, OAuth, OIDC, and service-to-service access
- Understanding of data protection, governance, risk management, and regulated industry control requirements
- Strong analytical and troubleshooting skills to investigate issues and translate findings into remediation
- Strong communication skills to explain technical risks and security requirements to engineering, technology, and business partners
- Experience collaborating across technical teams to operationalize security controls in complex enterprise environments
Tools and technologies you may work with
- AI Gateway, GenAI, Model Context Protocol (MCP)
- SIEM, SOAR, ITSM, SSE, SASE, CASB, DLP
- OAuth, OIDC, Python, PowerShell, APIs
Compensation and transparency
The salary range for this position is $114,000 - $152,000 per year, plus an opportunity to earn additional incentive earnings. Actual pay is based on factors including budget, work location, and relevant skills and experience.
Background check
Any offer of employment is conditioned upon successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results are reviewed based on applicable legal requirements and the nature and gravity of the background history and the job offered.
Preferred qualifications
- CISSP, CCSP, CISM, or comparable security certifications
- Direct experience with AI Gateway technologies or enterprise GenAI security controls
- Experience with AI Security, DLP, SSE, SASE, CASB, DSPM, or related data protection platforms
- Experience with Cyera Omni, Netskope AI Security, AISecOps, or similar technologies
- Familiarity with Python, PowerShell, APIs, automation, reporting, and workflow orchestration
- Experience working in financial services, healthcare, or other highly regulated industries
- Experience implementing risk-based enforcement models, exception management processes, and security control evidence
- Experience securing agentic AI environments, MCP enabled integrations, AI agents, non human identities, prompt and upload workflows, and GenAI data leakage scenarios
Awards and recognition
- Dave Thomas Foundation’s Best Adoption-Friendly Workplace
- Disability:IN World’s Top Disability Inclusive Business
- Glassdoor Best Place to Work in Consulting, Finance & Insurance
- Human Rights Campaign Corporate Equality Index 100 Award
- Newsweek America’s Most Charitable Company
- The Banker’s US Bank of the Year
