Associate Director, AI & Application Security - HYBRID ROLE

Job Overview This hybrid position requires working from the Vertex office in Boston three days a week. Vertex is seeking a Senior Principal Engineer, AI & Application Security to lead security for AI‑enabled applications, platforms, and services across the enterprise. The role secures AI throughout the full lifecycle—from design and development to deployment and ongoing operations—including generative AI, agentic workflows, traditional machine learning, and AI embedded in enterprise applications. Key Responsibilities Lead AI and application security across the full lifecycle of AI‑enabled systems, from design and development through deployment and operations. Define and evolve security standards, guardrails, and control expectations for AI systems used across Vertex. Apply and operationalize industry‑recognized security frameworks and control models, including NIST AI Risk Management Framework (AI RMF), NIST Cybersecurity Framework (CSF), OWASP Top10, and OWASP Top10 for LLM and Generative AI Applications. Secure AI workloads and AI‑enabled applications across cloud and SaaS environments, with emphasis on policy enforcement, data protection, logging, telemetry monitoring, and operational visibility. Lead threat modeling and misuse‑case analysis for AI systems (e.g., prompt injection, prompt abuse, sensitive data leakage, tool or action abuse, unsafe outputs, model misuse). Define and mature AI guardrails, including monitoring, detection, logging, and misuse or negative testing practices. Establish secure development expectations for AI‑enabled applications and services, including secure coding practices and appropriate separation of development and production environments. Build and lead application security testing practices for AI‑enabled applications and supporting services, including SAST, DAST, automated scanning, and retesting processes. Partner with Cloud Security, Security Operations, Privacy, Legal, Data Science, and Engineering teams to align security controls with business, technical, and regulatory requirements. Influence architecture and platform decisions through practical, risk‑based guidance that can scale with AI adoption. Communicate risks, tradeoffs, and recommendations clearly to both technical teams and senior leadership. Knowledge and Skills Cloud security architecture and controls across Azure and AWS Familiarity with GCP security concepts and services Secure software development life cycle (SDLC) practices Secure coding standards and code review practices SAST, DAST, automated security scanning, and remediation workflows OWASP Top10 and common application and API security risks Familiarity with OWASP guidance for LLM/GenAI applications API security, identity and access management, secrets management, and service‑to‑service trust Logging, telemetry, monitoring, and detection for cloud‑native environments Threat modeling and misuse‑case analysis Familiarity with AI security risks, including prompt injection, data leakage, model misuse, tool or action abuse, unsafe outputs, and policy enforcement Familiarity with AI platforms and providers such as Microsoft Copilot / Azure OpenAI, Anthropic, Google Gemini, AWS Bedrock, and emerging AI platforms and services Education and Experience Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field (or equivalent experience). Significant experience in application security, product security, cloud security, or a related cybersecurity discipline; strong experience securing cloud environments, particularly Azure and AWS (familiarity with GCP is a plus); deep knowledge of application security fundamentals and secure software development practices; experience securing APIs, platforms, and complex distributed systems; experience leading threat modeling, architecture reviews, and risk‑based security assessments; experience applying security and risk frameworks in engineering environments, including familiarity with NIST AI RMF, NIST CSF, and common application security standards; demonstrated ability to partner effectively with engineering and platform teams to embed security into design and delivery processes; experience securing generative AI applications, agentic workflows, or machine learning‑enabled services; experience defining AI guardrails and monitoring strategies at scale; excellent communication and influence skills, with the ability to engage both technical teams and senior leaders. Preferred Qualifications Experience working in biopharmaceutical or other GxP‑regulated environments with strong privacy and data protection requirements. Pay Range $172,000 – $258,000 (based on skills, competencies, and experience). The role is eligible for an annual bonus and annual equity awards; some roles may also be eligible for overtime pay in accordance with federal and state requirements. Benefits Vertex offers inclusive, market‑leading benefits, including medical, dental, and vision coverage; generous paid time off (including a week‑long company shutdown in the Summer and the Winter); educational assistance programs such as student loan repayment; a generous commuting subsidy; matching charitable donations; a 401(k) plan with match; and additional resources to support personal and professional growth. Flex Designation Remote‑Eligible. You may work remotely up to five days per week, with optional on‑site visits. Options include: Remote: work remotely five days a week and come into the office on occasion. Hybrid: work remotely up to two days per week. On‑Site: work five days per week on‑site with ad‑hoc flexibility. Equal Employment Opportunity Vertex is a global biotechnology company that is committed to equal employment opportunity and non‑discrimination for all employees and qualified applicants, regardless of race, color, sex, gender identity or expression, age, religion, national origin, ancestry, ethnicity, disability, veteran status, genetic information, sexual orientation, marital status, or any characteristic protected under applicable law. Vertex is an E‑Verify Employer in the United States. Vertex will make reasonable accommodations for qualified individuals with known disabilities, in accordance with applicable law. Any applicant requiring an accommodation in connection with the hiring process or to perform the essential functions of the position should contact Talent Acquisition. #J-18808-Ljbffr Vertex Pharmaceuticals Inc (US)