AI Security & DevOps Engineer

About Casper Studios

We’re an AI services firm that helps companies figure out where and how to use AI. We’ve bootstrapped Casper Studios to roughly 40 people, worked with 30+ clients, and done deals with some of the largest companies, PE funds, and model providers.

The reason comes down to how we work with clients. Before we build anything, we listen, understand the business, and help them figure out the highest-leverage way to get started on their AI journey.

About the Role

We’re hiring an AI Security & DevOps Engineer to own how Casper takes AI systems from prototype to production securely. This role will set and enforce the technical standard: threat models, secure defaults, authentication and secrets patterns, CI/CD gates, and the agent-specific controls that AI systems need and traditional security programs don’t cover. In parallel, this role will own the client security conversation: engaging their security team early, translating their requirements into what we build, and producing the evidence that gets an enterprise deployment approved.

The AI Security & DevOps Engineer will work across every engagement rather than sitting on one. Our clients are largely regulated enterprises on Microsoft stacks, so the work spans identity, cloud, data protection, and the newer surface of agents, tools, and connectors. This position will be the person who knows the difference between a proof of concept and a production system in a bank, scales the rigor accordingly, and decides what ships.

What You’ll Do

• Own Casper’s dev-to-production security standard and make it something engineers actually use
• Define and run the security gate in our delivery process: threat models, design reviews, and the call on what ships
• Harden what we build - identity and authentication, secrets management, data protection, egress controls, and the agent surface: prompt injection, tool and connector permissioning, untrusted input in agent loops, MCP auth
• Own the platform work security depends on: CI/CD, automated scanning and review across our repos, infrastructure-as-code, environment and access management, logging and telemetry
• Audit our own repos and internal systems, and fix what you find
• Lead the client security conversation - engage their security team early, extract requirements, map approved and unapproved vendors, and produce the threat models and evidence packs that clear review the first time
• Set our point of view on preferred vendors for auth, secrets, telemetry, and scanning so engagements stop relitigating the same decisions
• Feed security into scoping - realistic timelines and a production roadmap that accounts for how long validation takes
• Raise the security bar across engineering through review, pairing, and written standards

What You’ll Bring

• Deep hands-on application and product security experience - you’ve threat modeled, found real vulnerabilities, and written the fixes yourself
• Real DevOps and platform depth: CI/CD, infrastructure-as-code, cloud (Azure especially, plus AWS/GCP), secrets management, and observability. You’ve built the pipeline, not just reviewed it
• Identity and authentication depth - OAuth/OIDC, SSO/SCIM, RBAC, conditional access - with working knowledge of Microsoft Entra
• Demonstrated LLM and agent security expertise: prompt injection, excessive agency, tool and connector permissioning, insecure output handling, retrieval abuse, and AI supply chain risk
• Secure SDLC in practice: SAST/DAST/SCA, dependency and supply chain controls, and automated review engineers don’t route around
• The judgment to right-size controls to the stage and the stakes
• Client-facing credibility - you can hold a room with an enterprise security team and translate risk into terms an executive can decide on
• AI-native mindset - you use modern AI tooling daily with customized workflows. You can’t threat model an agent system you’ve never built with
• High agency and strong writing. The standards, evidence packs, and memos are yours, and they need to be good enough that busy people act on them

Nice to Haves

• Regulated-industry exposure - financial services, healthcare, or another environment where security review is genuinely adversarial
• Consulting, agency, or forward-deployed background where you earned trust with a client’s security org rather than inherited it
• Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, or ISO 42001
• SOC 2 or …