Senior Security Engineer, AI Governance

Job highlights

• Non-accommodation-related requests,such as application follow-ups or technical issues,will not be addressed. . Our interviews are supported by BrightHire,a tool that helps us create a consistent and thoughtful interview experience and may include recordings
• threat modeling experience applied to AI or novel technology stacks is a plus.

What You Can Expect

As a Senior Security Engineer on Zooms Enterprise Security team, you will own the AI Governance program end to end, defining the technical standards and risk posture that determine how Zoom adopts AI safely and at scale. On any given day, you will be assessing emerging AI use cases, building security frameworks for GenAI and agentic systems, and serving as the trusted technical voice on AI security for engineering and enterprise stakeholders across four critical domains. This is a hands-on, highly autonomous role that calls for real depth in both AI/ML systems and security engineering; candidates without working familiarity with how modern AI introduces security risk will not be set up for success here. You will work as part of a globally distributed, multi-domain security engineering team, collaborating closely with colleagues across time zones and contributing across adjacent security domains beyond AI.

About the Team

Zooms Enterprise Security team is the engineering foundation behind how the company identifies, contains, and gets ahead of risk across its most critical systems. Working across AI, data, network, endpoint, and cloud security, the team builds the controls, standards, and architectures that let Zoom move quickly without creating unacceptable exposure. As Zoom deepens its investment in AI across Zoom Workplace and its broader platform, this teams work is increasingly central to how the company grows responsibly.

Responsibilities

• Own the AI governance risk register and end-to-end assessment methodology across four domains (GenAI, Agentic AI, Shadow AI/Local AI, and AI Gateway/MCP); conduct and review risk evaluations using Likelihood x Impact scoring and drive remediation with owning engineering teams.
• Identify and prioritize security gaps in GenAI deployments including prompt injection, data leakage, model misuse, and insecure output handling; define monitoring and guardrail requirements for agentic systems operating with significant autonomy and tool access.
• Lead the Shadow AI governance strategy end to end, from quantifying risk exposure to recommending and operationalizing detection and enforcement controls across the enterprise.
• Set the security bar for AI gateway and Model Context Protocol (MCP) implementations, including secure configuration, access control frameworks, and governance coverage.
• Architect reference security patterns for AI adoption (AI gateways, MCP servers, agent frameworks, LLM integrations) and serve as design authority in AI-related architecture reviews; translate the AI Governance Risk Charter into a concrete roadmap of technical requirements and measurable outcomes.
• Drive evaluations of AI security tooling (AI gateways, CASB/SWG, agentic monitoring, MCP governance solutions), including POC design, cost-benefit analysis, and leadership recommendations; author and maintain security standards and policy for AI adoption.
• Lead security architecture reviews and risk assessments across adjacent domains including Network, Endpoint, Cloud, and Data Security; contribute to incident response, detection engineering, and purple team exercises as shared team functions.
• Serve as the primary technical partner to AI/ML, engineering, and enterprise teams; lead cross-functional working groups, mentor engineers on risk analysis and documentation quality, and deliver clear reporting on AI risk posture and forecasted challenges to leadership.

What Were Looking For

• 8+ years of security engineering or cybersecurity experience, including end-to-end ownership of a security domain or program, with a track record of driving risk assessment, prioritization, and remediation across cross-functional teams.
• Solid working knowledge of modern AI/ML systems and the security risks they introduce (LLMs, generative AI, agentic systems); direct experience securing GenAI or LLM-based applications in an enterprise environment is a strong differentiator.
• Understanding of AI gateways, Model Context Protocol (MCP), CASB/SWG, or DLP tooling, and a working understanding of shadow AI detection …