Application Security & AI Engineering - Senior Manager

We are seeking a Senior Manager, Application Security & AI Engineering to lead the design, implementation, and transformation of secure software development and AI-enabled applications. This role will drive Secure-by-Design practices, enterprise threat modeling, DevSecOps, AI security, and GenAI governance across cloud-native and digital platforms. The role is grounded in how developers work today: in AI-assisted IDEs and agentic coding workflows, where security must be a native part of the authoring experience rather than a downstream gate., * Define and execute Application Security and AI Security strategy, architecture standards, and transformation roadmaps.

• Lead Secure Software Development Lifecycle (SSDLC) and DevSecOps initiatives across product and engineering organizations.
• Govern the use of AI coding assistants and autonomous coding agents across the SSDLC, defining sandboxing, credential scoping, tool-access boundaries, and review standards for AI-authored code.
• Shift security review in-line to the point of authorship, embedding automated and AI-assisted review in the IDE and in pull requests so developers receive high-confidence, fix-ready feedback as they write code.
• Address the risks introduced by AI-generated and prompt-driven development, including code provenance, hallucinated or typosquatted dependencies, and prompt injection reaching agents that hold repository or pipeline access.
• Establish and scale threat modeling programs using STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS, attack trees, and abuse cases.
• Conduct security architecture reviews and risk assessments for applications, APIs, microservices, cloud services, and AI solutions.
• Design and oversee SAST, DAST, Software Composition Analysis, API Security, Container Security, and Cloud Security capabilities.
• Architect secure AI and GenAI solutions, including LLM applications, copilots, Retrieval-Augmented Generation platforms, and agentic AI systems.
• Develop controls for AI agents, autonomous workflows, model access, prompt security, data protection, guardrails, and responsible AI governance.
• Partner with engineering, product, cloud, data, and cyber teams to embed security throughout the development lifecycle.
• Mentor application security architects, AI engineers, DevSecOps professionals, and security consultants., * Threat Modeling: STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS , threat-modeling-as-code, and automated threat modeling integrated into the delivery pipeline.
• Application Security: Semgrep, CodeQL, Snyk, reachability-based software composition analysis, Burp Suite, and the OWASP Top 10 for web, API, and LLM applications.
• Cloud & DevSecOps: Azure, AWS, Google Cloud, Kubernetes, Terraform, GitHub Actions, GitLab CI, and Azure DevOps, with policy-as-code enforcement using OPA or Kyverno.
• AI & GenAI: Azure AI Foundry, OpenAI, Anthropic, Vertex AI, Amazon Bedrock, LangGraph, OpenAI Agents SDK, Claude Agent SDK, and the Model Context Protocol.
• AI-Assisted Development: Cursor, Claude Code, GitHub Copilot, and OpenAI Codex, including agent rules and context files, Model Context Protocol tooling, agent sandboxing, and in-line security review workflows.
• AI Security: AI threat modeling, red teaming, prompt-injection testing, RAG security, agent security, model risk, guardrails, and responsible AI governance.

Preferred Certifications

CISSP, CSSLP, CCSP, CISM, GWAPT, CKS, and relevant Microsoft, AWS, Google Cloud, AI Security, or Responsible AI certifications.

What You’ll Bring

A passion for building secure digital products and AI-powered solutions. You will help organizations reduce risk, accelerate innovation, and enable trusted AI adoption through strong threat modeling, secure engineering practices, and modern application security capabilities.

Differentiator: Day-to-day, hands-on experience with agentic development tools, particularly Cursor and Claude Code alongside with experience leading enterprise Secure AI SDLC, AI Red Teaming, and AI Governance programs.

• 10+ years of experience in application security, software engineering, cloud security, AI engineering, or cybersecurity.
• Deep expertise in secure application architecture, threat modeling, vulnerability management, attack-path analysis, and Secure-by-Design principles.
• Experience leading enterprise-scale Application Security, DevSecOps, or secure engineering transformation programs.
• Strong understanding of cloud-native architectures, APIs, microservices, containers, and AI/GenAI technologies.
• Current, hands-on experience building software with agentic development tools such as Cursor, Claude Code, and GitHub Copilot, including how to configure and secure them for enterprise use.
• Excellent leadership, executive communication, client-facing, and stakeholder management capabilities.

At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers.

• We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is:
• New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices - $185,800 to $385,700
• Bay Area California offices - $193,500 to $401,600
• All other offices locations in the US, including Sacramento - $154,700 to $353,500
• Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
• Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.

We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world., * At EY, our values set the foundation for how we work and the behaviors we expect of our people. Any misrepresentation or falsification of information or lack of integrity at any point in the recruiting process may result in withdrawal of your candidacy, revocation of an offer or immediate termination of employment.

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.