Senior Engineer, AI Product Security

College Board – Technology – Infrastructure & InfoSec

Location: This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).

Type: This is a full-time position

About the Team

The College Board Product Security team is a close-knit and enthusiastic group of technologists with a thirst for knowledge in security and cloud. We collaborate closely to investigate and solve problems and have strong alignment with our product teams to be a step ahead in securing the organization’s suite of products. We are an agile organization, embracing AI and cloud-native systems, and are focused on improving speed and security of service delivery in support of our important mission. Our team comes from a wide variety of backgrounds as well as experience within the security space and we work to ensure everyone on the team has a voice.

Product Security Engineers work closely with product and engineering teams as well as other organizational stakeholder groups to achieve product and security business objectives. They support threat modelling, architecture design, and implementation of secure development practices. In addition, they help define organizational security standards and organizational capability and tooling adoption decisions.

About the Opportunity

As a Senior Product Security Engineer, you will embed with assigned product and engineering teams to own security across the full development lifecycle, from feature-level design review and threat modeling through vulnerability remediation and production monitoring. This includes a heavy focus on securing AI features built into College Board’s products, implementing AI-native security tooling and features, and assessing and mitigating the risks that AI development tools introduce into the software supply chain. You will join planning and grooming sessions as the team’s security partner, translating compliance and requirements and security risks into guidance engineers can act on.

You will lead risk assessments, provide prioritization advice, and drive mitigation of risks. Alongside that product or engineering team work, you will coach developers on security practices, including the responsible use of AI coding tools.

This role is equal parts hands-on security engineering and organizational enablement. Your work will directly protect platforms that serve millions of students and educators worldwide.

In this role, you will:

Partner with Product and Engineering Teams (50%)

• Serve as the security partner for assigned product and engineering teams; join planning, grooming, and design sessions to advise on security architecture and flag risk early.
• Own threat models and risk assessments for assigned products; communicate security risks and mitigation plans to technical and nontechnical stakeholders.
• Own the security engagement lifecycle for each assigned product, from design review and documentation through production deployment and monitoring.
• Lead vulnerability reviews and remediation; assess exploitability to set accurate risk priority.
• Apply knowledge of emerging best practices in AI security, CB’s security policies, and compliance requirements (SOC 2, ISO 27002, PCI, PII) to guide product teams.
• Write and review security design documentation and code; give and receive direct feedback in design reviews. Ensure assigned products meet Product Security Framework requirements; identify gaps and drive remediation.

Elevate Product Security (25%)

• Coach product teams and junior engineers through discussions, code reviews, and hands-on training to advance secure SDLC practices.
• Grow and mature the AI Product Security program; develop security controls and guidance in the use of AI in software engineering, in our products, and in our security program.
• Document and share emerging security patterns; keep your knowledge accessible to the full team. Stay current with industry trends; apply what you learn to improve the partner program.

Drive Operational Improvement (25%)

• Deploy and operate security tooling across cloud environments; integrate automated security controls into CI/CD pipelines.
• Contribute to roadmap planning and strategic direction: identify security risks and opportunities, escalate issues with cross-team scope, and synthesize feedback to inform priorities.
• Define and track KPIs that measu…