Senior Cybersecurity Engineer I at American Express in Bengaluru, KA

Job description

The Enterprise Technology Services organization partners with every part of the American Express business to power the company’s growth and innovation with trust and efficiency, and drive competitive differentiation with speed. We support the delivery and operations of technology, digital, and data capabilities, platforms, and services globally. Specifically, our team is responsible for the company’s technology engineering, architecture, and infrastructure, providing 24x7 support to ensure an uninterrupted, high-quality experience for customers and colleagues. We also provide product management for core enterprise platforms, and lead technology risk and information security, enterprise data governance and platforms, digital product and design, and enterprise AI platforms on behalf of the company. We are seeking an AI/ML Security Data Scientist to develop, evaluate, govern, and operationalize machine-learning security controls that protect enterprise generative-AI applications and traditional machine-learning systems. This position will own critical capabilities involving prompt-injection detection, LLM vulnerability assessment, audio redaction, adversarial-model testing, and secure-model-development practices. The successful candidate will combine strong applied data-science skills with an understanding of cybersecurity, model-risk governance, production ML operations, and regulatory documentation. The role will work closely with AI Firewall engineering, AI Security Enablement, Model Risk Management, Technology Risk and Information Security, product owners, auditors, and external technology providers. AI security model development and evaluation: Develop, evaluate, and improve machine-learning controls for prompt-injection detection, LLM vulnerability detection, sensitive-data redaction, and related AI-security use cases. Benchmark open-source, internally developed, and third-party models using representative test datasets. Design training, validation, out-of-sample, and out-of-time evaluation datasets using sound sampling, labeling, and data-quality practices. Evaluate model performance using recall, precision, F1 score, Matthews correlation coefficient, accuracy, ROC-AUC, confusion matrices, and other appropriate measures. Recommend operating thresholds that balance detection effectiveness, false positives, operational impact, and business risk. Evaluate emerging audio, image, and video deepfake-detection technologies where relevant to the AI-security portfolio. Model-risk management and governance: Own and maintain model documentation for BERT-based prompt-injection detection, LLM vulnerability assessment, and other assigned AI-security models. Prepare model-validation submissions and coordinate responses to Model Risk Management Group requests. Document model purpose, methodology, datasets, assumptions, limitations, compensating controls, performance results, implementation testing, and ongoing monitoring. Define class-level performance monitoring and feature-, concept-, and probability-distribution-drift controls. Establish escalation, remediation, retraining, fallback, and model-deactivation criteria. Ensure documentation is internally consistent, technically defensible, traceable to evidence, and ready for independent review or audit. Audio redaction and sensitive-data protection Support the design and implementation of audio-redaction capabilities for enterprise AI applications. Assess centralized-service and embedded-SDK deployment approaches, including scalability, auditability, separation of duties, maintainability, language independence, and circumvention risk. Develop evaluation datasets and acceptance criteria for detecting and redacting sensitive data in voice and audio interactions. Partner with platform and application teams to integrate audio-redaction capabilities into production workflows. Secure model development lifecycle Conduct adversarial stress testing and robustness assessments for NLP, large-languag