About the job
We seek a talented L5 Security Engineer specializing in Generative AI (GenAI) Security to join our team. This role is critical to identifying and managing the risks posed by existing and emerging GenAI threats within Netflix. You will help drive the development of scalable technical security controls that enhance business agility and reduce risk. In this role, your primary focus will be on GenAI Security for workforce-related business scenarios.
Responsibilities
Identifying and mitigating GenAI threats; educating stakeholders; providing direct security support to internal partners; evaluating the security posture of third-party GenAI products and their integration with internal/external systems (via MCP, OAuth, etc.); conducting risk-based security assessments; developing hardening guides and remediation strategies; performing technical validation via threat modeling, penetration testing, code review (when possible), and control-based attestation using classical Third Party Risk Management (TPRM) techniques; prototyping new tooling; leveraging GenAI for security automation; performing build-vs-buy evaluations; translating complex technical risks into clear business risks for stakeholders; standard business-hours support for Workforce Security Operations; infrequent 24/7 Incident Response participation.
Qualifications
Minimum
Ability to learn and spin up rapidly on quickly evolving GenAI solutions and security concerns; some exposure to commercially available GenAI solutions related to search (RAG) and low-code/no-code agentic solutions from major AI 3rd party vendors (Anthropic, OpenAI, Google, Microsoft); high-level understanding of Machine Learning/AI fundamentals and architecture, including MCP, A2A, and LLMs; high-level understanding of GenAI Governance; GenAI threat taxonomy knowledge — OWASP GenAI Top 10; threat modeling/penetration testing/code review/code comprehension skills; familiarity with modern GenAI development tools and techniques; familiarity with Third-Party Risk Management (TPRM) methodologies; scripting ability (not production-level; use of GenAI is sufficient); autonomously drives work delivery (bias to action); cross-functional collaboration skills; high-level familiarity with functionality of commercially available corporate security tooling in endpoint, identity, data, and vendor security; ability to navigate ambiguity by taking strategic goals and decomposing them into actionable project plans; using measurement and metrics to drive decision-making and outcomes.
Preferred
Value a deeply collaborative team; use data to inform judgment and support/communicate decisions; effectively communicate complex subjects to internal customers and partners; enjoy taking full ownership of open-ended problems, from concept to product, and effectively managing own time; care about improving systems and leaving things better than found; believe diverse and inclusive teams are critical to sustainability and effectiveness; empathize with customers and have interest in overall product lifecycle; challenge status quo and seek novel, customer-centric problem-solving.