Application Security & AI Engineering - Senior Manager

Join a team focused on secure-by-design engineering and responsible AI. This Senior Manager role in Application Security & AI Engineering is based in Dallas, TX (onsite), with compensation ranging from USD 185,800 to 401,600 per year. You will lead the design, implementation, and transformation of secure software development and AI-enabled applications, partnering across engineering, product, cloud, data, and cyber to embed security throughout the delivery lifecycle.

Responsibilities

• Define and execute Application Security and AI Security strategy, architecture standards, and transformation roadmaps.
• Lead Secure Software Development Lifecycle (SSDLC) and DevSecOps initiatives across product and engineering organizations.
• Govern the use of AI coding assistants and autonomous coding agents across the SSDLC, including sandboxing, credential scoping, tool-access boundaries, and review standards for AI-authored code.
• Shift security review to align with the point of authorship by embedding automated and AI-assisted review in the IDE and in pull requests, delivering high-confidence, fix-ready feedback.
• Address risks introduced by AI-generated and prompt-driven development, including code provenance, hallucinated or typosquatted dependencies, and prompt injection reaching agents with repository or pipeline access.
• Establish and scale threat modeling programs using STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS, attack trees, and abuse cases.
• Perform security architecture reviews and risk assessments for applications, APIs, microservices, cloud services, and AI solutions.
• Design and oversee SAST, DAST, Software Composition Analysis, API Security, Container Security, and Cloud Security capabilities.
• Architect secure AI and GenAI solutions, including LLM applications, copilots, Retrieval-Augmented Generation platforms, and agentic AI systems.
• Develop controls for AI agents and autonomous workflows, including model access, prompt security, data protection, guardrails, and responsible AI governance.
• Mentor application security architects, AI engineers, DevSecOps professionals, and security consultants.

Requirements

• 10+ years of experience in application security, software engineering, cloud security, AI engineering, or cybersecurity.
• Deep expertise in secure application architecture, threat modeling, vulnerability management, attack-path analysis, and Secure-by-Design principles.
• Experience leading enterprise-scale Application Security, DevSecOps, or secure engineering transformation programs.
• Strong understanding of cloud-native architectures, APIs, microservices, containers, and AI/GenAI technologies.
• Current, hands-on experience building software with agentic development tools such as Cursor, Claude Code, and GitHub Copilot, including configuring and securing them for enterprise use.
• Excellent leadership, executive communication, client-facing, and stakeholder management capabilities.

Technologies

STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS, SAST, DAST, Software Composition Analysis, API Security, Container Security, Cloud Security, LLM applications, Retrieval-Augmented Generation, agentic AI systems, Semgrep, CodeQL, Snyk, Burp Suite, OWASP Top 10, Azure, AWS, Google Cloud, Kubernetes, Terraform, GitHub Actions, GitLab CI, Azure DevOps, OPA, Kyverno, Azure AI Foundry, OpenAI, Anthropic, Vertex AI, Amazon Bedrock, LangGraph, OpenAI Agents SDK, Claude Agent SDK, Model Context Protocol, along with AI threat modeling, RAG security, attack trees, and abuse cases.

Benefits

• Comprehensive compensation and benefits package with medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
• Flexible vacation policy to decide how much vacation time you need based on personal circumstances.
• Time off for EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed.

Preferred Skills & Technologies

• Threat Modeling: STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS, threat-modeling-as-code, and automated threat modeling integrated into the delivery pipeline.
• Application Security: Semgrep, CodeQL, Snyk, reachability-based software composition analysis, Burp Suite, and OWASP Top 10 for web, API, and LLM applications.
• Cloud & DevSecOps: Azure, AWS, Google Cloud, Kubernetes, Terraform, GitHub Actions, GitLab CI, Azure DevOps, with policy-as-code enforcement using OPA or Kyverno.
• AI & GenAI: Azure AI Foundry, OpenAI, Anthropic, Vertex AI, Amazon Bedrock, LangGraph, OpenAI Agents SDK, Claude Agent SDK, and the Model Context Protocol.
• AI-Assisted Development: Cursor, Claude Code, GitHub Copilot, and OpenAI Codex, including agent rules and context files, Model Context Protocol tooling, agent sandboxing, and in-line security review workflows.
• AI Security: AI threat modeling, red teaming, prompt-injection testing, RAG security, agent security, model risk, guardrails, and responsible AI governance.

Preferred Certifications

• CISSP, CSSLP, CCSP, CISM, GWAPT, CKS, and relevant Microsoft, AWS, Google Cloud, AI Security, or Responsible AI certifications.

Differentiator: Day-to-day, hands-on experience with agentic development tools, particularly Cursor and Claude Code, alongside experience leading enterprise Secure AI SDLC, AI Red Teaming, and AI Governance programs.

Location: Dallas. Other locations: Anywhere in Region.

Salary: Competitive. Regional base salary ranges may apply (New York City, Boston, and Washington DC Metro Areas, Washington State, Southern California: $185,800 to $385,700; Bay Area, CA: $193,500 to $401,600; other US locations including Sacramento: $154,700 to $353,500). Individual salaries are determined based on factors including education, experience, knowledge, skills, and geography.