Sr Product Security Engineer, AI & DevSecOps

McKesson is seeking a senior security engineer to embed product security across the full software development lifecycle for AI-enabled offerings, cloud-native platforms, and DevSecOps workflows. In this onsite role in Columbus, OH, you will work closely with engineering and platform partners to turn security requirements into reusable patterns and automated guardrails that teams can adopt consistently.

Role focus

This position centers on integrating security requirements into application design, development, testing, deployment, and operations. You will contribute to security architecture and threat-focused reviews, strengthen secure coding practices through code assessment, and help teams assess and secure AI, machine learning, generative AI, and large language model solutions, including the secure use of AI-assisted development tools.

Responsibilities

• Partner with development teams to incorporate security requirements across the application lifecycle, from design through operations
• Perform security architecture reviews, threat modeling, secure design reviews, and assessments for applications, APIs, cloud services, and AI-enabled systems
• Write and review code to identify vulnerabilities, attack vectors, and opportunities to improve secure development practices
• Develop reusable security patterns, shared services, and automated guardrails to help engineering teams deliver securely and efficiently
• Assess and secure AI, machine learning, generative AI, and large language model solutions, including secure use of AI-assisted development tools
• Integrate automated security testing into CI/CD pipelines, including SAST, DAST, software composition analysis, secrets detection, container scanning, and infrastructure scanning
• Design security controls for cloud-native applications, containers, Kubernetes, serverless platforms, and infrastructure-as-code deployments
• Coordinate with engineering and cybersecurity teams to assess risk, remediate vulnerabilities, respond to security concerns, and promote a security-first engineering culture

Requirements

• Degree in Computer Science, Information Security, Engineering, or a related technical field, or equivalent professional experience
• Typically 7 or more years of relevant experience in application security, product security, software development, security engineering, DevSecOps, or a related discipline
• Hands-on experience writing, reviewing, and deploying application code using TypeScript, Java, Ruby, Python, or comparable languages
• Strong understanding of application attack vectors, secure coding practices, software vulnerabilities, and modern application architectures
• Experience conducting threat modeling, security architecture reviews, secure design reviews, and vulnerability remediation
• Experience implementing DevSecOps practices and integrating automated security controls into CI/CD pipelines
• Experience securing AI/ML platforms, generative AI solutions, large language model applications, or AI-assisted development workflows
• Experience with cloud platforms, containers, Kubernetes, infrastructure-as-code, security automation, and application security testing tools

Technologies

TypeScript, Java, Ruby, Python; SAST, DAST, software composition analysis, secrets detection, container scanning, infrastructure scanning; cloud-native applications, containers, Kubernetes, serverless platforms, infrastructure-as-code; AI, machine learning, generative AI, large language model, AI-assisted development tools; CI/CD pipelines; threat modeling; security architecture reviews; secure design reviews; vulnerability remediation.

Compensation

Estimated salary range: USD 140,300 - 233,800 per year.

Benefits

• Medical, Dental, and Vision
• Health Spending Accounts
• Flexible Spending Accounts
• 401(k) (U.S.)
• Pension (Canada)
• Employee Stock Purchase Plan
• Mental Health Programs
• Flexible Schedules
• Paid Time Off
• Wellness Program
• Education Reimbursement
• Volunteer Opportunities
• Flexible Work Environment

Preferred skills and experience

• Knowledge of AI security frameworks and controls, including OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework
• Experience creating reusable security services, secure development patterns, engineering guardrails, or policy-as-code solutions
• Experience with CI/CD and infrastructure technologies such as GitHub Actions, Azure DevOps, GitLab, Jenkins, or Terraform
• Experience supporting frameworks such as SOC 2, HIPAA, SOX, NIST CSF, or ISO 27001
• Ability to translate complex security requirements and technical risks into practical guidance for development teams
• Strong collaboration and influencing skills, with the ability to advance security without unnecessarily slowing product delivery