AI Security Consultant

AI Security ConsultantAI Security Consultant is a hands-on technical contributor responsible for reviewing, evaluating, and validating AI initiatives across CNA's enterprise. This role performs architecture and design reviews of AI, Machine Learning (ML), Generative AI (GenAI), Large Language Model (LLM), and agentic solutions; develops technology evaluation criteria for RFIs/RFPs; and tests and validates candidate solutions against security requirements. As part of the AI Governance review process, this role is a representative of the AI Security team and provides the technical security perspective on AI threats — focusing on the technical security assessment rather than governance, risk, or compliance functions, which are owned by dedicated teams. The specialist applies deep technical expertise to identify risks in AI systems and data pipelines and recommends practical controls and remediations, partnering closely with the AI Security team, Engineering, Cloud Security, Application Security, IAM, Data Security, and AI Governance.Essential Duties & Responsibilities Serve as the AI Security team's technical reviewer within the AI Governance review process, providing the security perspective on AI threats and risks. Conduct architecture and design reviews of AI/ML, GenAI, LLM, and agentic initiatives, documenting findings, risks, and recommended controls. Write and maintain technology evaluation criteria for RFIs and RFPs covering AI security tooling and solutions. Test, validate, and benchmark candidate AI security solutions through proofs of concept and hands-on assessments. Perform threat modeling and security risk assessments of AI systems, models, and data pipelines. Evaluate AI workload security across cloud environments (AWS, Google Cloud) and recommend secure configurations. Apply industry standards and frameworks (e.g., NIST AI RMF, OWASP Top 10 for LLMs, MITRE ATLAS) to reviews and assessments. Contribute to AI security standards, reference architectures, and best-practice guidance. Support integration of AI security controls into SDLC, CI/CD, and DevSecOps workflows. Assist with vulnerability management, security monitoring, and incident readiness for AI systems. Provide technical security input to Risk, Legal, and AI Governance teams to support their compliance and regulatory work. Track emerging AI threats, attack techniques (e.g., prompt injection, data poisoning, model extraction), and defensive practices.Reporting Relationship Typically reports to Director or above.