> Markdown version of [/jobs/ext/2098113-principal-architect-product-security](https://www.wearedevelopers.com/jobs/ext/2098113-principal-architect-product-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Architect, Product Security - **Company:** ACV, Inc. - **Location:** Buffalo, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Computer Vision, Burp Suite, Cloud Computing Security, Cyber Security, Information Leak Prevention, Github, Information Systems Security Architecture Professional, Python (Programming Language), Machine Learning, Open Web Application Security, Azure Machine Learning, Sherwood Applied Business Security Architecture, Secure Coding, Large Language Models, Multi-Agent Systems, Sonatype, Software Security, Containerization, Kubernetes, Free and Open-Source Software, Machine Learning Operations, Checkmarx, Api Design, Static Application Security Testing, Dynamic Application Security Testing - **Published:** August 17, 2026 - **Apply:** https://www.dice.com/job-detail/dd44b539-5c56-49ae-af24-352258c068ff ## About the Role * Ability to read, write, speak and understand English. * Bachelor's degree in a related field, or commensurate experience. * 12+ years' of security experience, 15+ years' without degree, including deep application security architecture. * Hands-on GenAI/LLM security work required, demonstrated through production experience or a verifiable body of work: AI red-team engagements, published research or tooling, open-source contributions, or AI security competition results. * 2+ years of production AI security experience preferred. * Security architecture: owns the enterprise secure-architecture vision for AI systems and application security. * AI/ML security depth: LLM application threats (prompt injection, insecure output handling, data leakage through retrieval, excessive agency in agents and tools) and model-level threats (poisoning, evasion, extraction, malicious pre-trained models). * Hands-on technical fluency: reads and writes code (Python preferred) and has personally used AI security tooling (e.g., Garak, PyRIT, promptfoo, or equivalent) rather than only evaluating vendors. * Frameworks: working fluency with the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, MITRE ATLAS, and NIST AI RMF, and the ability to turn them into standards engineers actually follow. * Standards and patterns: defines reference architectures and paved-road standards, including for AI-assisted development. * Influence: aligns engineering and ML leadership to the target architecture. * Application security (commensurate with level): OWASP Top 10, secure code review, threat modeling, and SAST/DAST/SCA tooling (e.g., Snyk, Checkmarx, GitHub Advanced Security, Burp Suite). * Cloud security (commensurate with level): cloud-native security on AWS, Kubernetes, and infrastructure-as-code; familiarity with ML platforms and inference infrastructure (e.g., SageMaker, Bedrock) a plus. * Comfort working in a fast-paced, cloud-native environment with clear written and verbal communication. * Illustrative credentials (a plus, not required): SABSA or equivalent architecture credentials, CCSP or a cloud security specialty. A demonstrated body of AI security work (research, tooling, red-team findings, AI CTF results, open-source contributions) carries more weight than any certification; the AI security credential market is not yet mature. #LI-AM3 ## Description Company-wide security architect for AI systems and the applications built around them. Defines ACV's target-state secure architecture, reference architectures, and standards for machine learning and LLM-powered systems, and guides the highest-risk AI and application designs across engineering. A P6 architecture-track role alongside Principal Engineer on the Product Security Career Ladder. Company / multi-year scope; owns AI and application security architecture and standards; sets direction on the most consequential design decisions. Focus areas: this role spans AI/ML security and application security. It is a technical architecture role. ACV's AI Governance function owns policy, risk registers, and regulatory alignment; this role owns the technical controls and architecture that make those policies real in production systems. What you will do: * Actively and consistently support all efforts to simplify and enhance the customer experience. * Define ACV's target-state secure architecture and reference patterns for AI/ML systems: LLM features, retrieval pipelines, agentic workflows, and the computer vision models behind vehicle condition and pricing. * Protect the integrity of ACV's vision-based condition and pricing pipeline against adversarial inputs and manipulated or AI-generated imagery, partnering with fraud and inspection teams on detection and image-provenance controls. * Set secure-by-default standards adopted across engineering for AI development: prompt injection defense, output handling, tool and agent permissioning, and model and training-data supply chain security. * Threat model and review the highest-risk AI and application designs, applying frameworks such as MITRE ATLAS and the OWASP Top 10 lists for LLM and Agentic Applications. * Own the security architecture for AI-assisted engineering: coding assistants, MCP servers, and autonomous agents, with guardrails that preserve developer velocity across an API-first engineering organization. * Stand up ACV's AI security testing capability: adversarial testing and red-teaming of models and LLM features, evaluation harnesses, and runtime guardrails, making deliberate build-vs-buy decisions. * Advise engineering and security leadership on multi-year AI security strategy, and partner with AI governance to translate policy into enforceable technical controls. * Scale AI security expertise across engineering, including through ACV's Security Champions program; mentor Staff and Principal engineers; and represent ACV's AI security architecture externally. * Perform additional duties as assigned., Compensation: The compensation range for this position is listed in the "Job Details" section at the bottom of this posting. Please note that final compensation will be determined based upon the applicant's relevant experience, skill set, location, business needs, market demands, and other factors as permitted by law. ## Related Videos - [Open sourcing a library: how hard can that be?](https://www.wearedevelopers.com/videos/1058-open-sourcing-a-library-how-hard-can-that-be) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [The AI Security Survival Guide: Practical Advice for Stressed-Out Developers](https://www.wearedevelopers.com/videos/1015-the-ai-security-survival-guide-practical-advice-for-stressed-out-developers) - [Bringing AI Model Testing and Prompt Management to Your Codebase with GitHub Models](https://www.wearedevelopers.com/videos/1536-bringing-ai-model-testing-and-prompt-management-to-your-codebase-with-github-models) - [Automated Security for the Entire SDLC](https://www.wearedevelopers.com/videos/100323-automated-security-for-the-entire-sdlc) - [CI/CD with Github Actions](https://www.wearedevelopers.com/videos/856-ci-cd-with-github-actions) ## Related Articles - [Got AI ideas but no money? Here are 10 free ways to level up your AI skills with Google Cloud](https://www.wearedevelopers.com/magazine/600-got-ai-ideas-but-no-money-here-are-10-free-ways-to-level-up-your-ai-skills-with-google-cloud) - [How to Become an AI Engineer](https://www.wearedevelopers.com/magazine/331-how-to-become-an-ai-engineer) - [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere) - [From Prototype to Production: Build AI Agents with This Free 4-Course Learning Path](https://www.wearedevelopers.com/magazine/655-from-prototype-to-production-build-ai-agents-with-this-free-4-course-learning-path) - [Dev Digest 210: AI Agents Are Go! Is MCP Dead? LLMs Crack Anonymity](https://www.wearedevelopers.com/magazine/709-dev-digest-210-ai-agents-are-go-is-mcp-dead-llms-crack-anonymity) - [MLOps And AI Driven Development](https://www.wearedevelopers.com/magazine/82-mlops-and-ai-driven-development)