Job Title: EVM Application AI Security Advisor
Duration: 6 Months
Location: Remote
Client: WWT/TD Bank
Bill: $60/C2C/ $50/W2
Responsibilities
The EVM Application Security Advisor – AI Portfolio provides specialized security advisory, governance, and vulnerability management support for applications leveraging Artificial Intelligence, Machine Learning, Generative AI, and related technologies. The role serves as the primary EVM/AppSec advisor for the AI application portfolio, partnering with application owners, engineering teams, security stakeholders, and governance functions to ensure AI-enabled applications meet Application Security requirements throughout their lifecycle.
The existing AppSec Advisory process already validates application scope, required security assessments, vulnerability remediation, and production readiness through APM/ServiceNow workflows. This position extends that model specifically to AI-enabled applications.
Key Accountabilities
AI Application Security Advisory
- Serve as the dedicated Application Security Advisor for the enterprise AI application portfolio.
- Provide security guidance for Generative AI, LLM, machine-learning, agentic AI, APIs, models, and AI-enabled application architectures.
- Partner with development teams early in the lifecycle to identify security requirements and appropriate testing.
- Maintain awareness of emerging AI attack techniques, vulnerabilities, and security-control developments.
AI Security Assessment & Adversarial Testing
- Coordinate and govern AI-specific security assessments, including adversarial testing.
- Review findings involving prompt injection, insecure model interaction, sensitive-data exposure, excessive agency, model/API abuse, and other AI-specific threats.
- Evaluate testing results and ensure identified risks are appropriately remediated, mitigated, or dispositioned.
- An existing internal communication specifically references an“AI Adversarial Testing Requirement,” indicating this is already relevant to the AppSec Advisor operating model. The available search result does not provide enough content to characterize that requirement further.
Vulnerability & Risk Management
- Provide oversight of security vulnerabilities affecting AI applications and supporting components.
- Review application vulnerabilities, remediation plans, risk reductions, exceptions, and mitigation requests.
- Challenge remediation and mitigation evidence and provide security recommendations based on exploitability and application context.
- Existing AppSec guidance requires advisors to verify assessment compliance and evaluate open Critical/High vulnerabilities before production approval.
- Leverage evolving capabilities such as AI-assisted reachability and exploitability analysis where available. Internal discussion describes Codewise using AI-powered reachability analysis to evaluate application code, dependencies, execution paths, supporting evidence, and mitigation packages for Security Advisor review.
Governance & Production Readiness
- Review AI applications against applicable Application Security standards and security requirements.
- Support APM lifecycle and production-readiness decisions for AI-enabled applications.
- Ensure required security assessments and vulnerability remediation activities are completed before production approval.
- Document advisory decisions, remediation requirements, exceptions, and risk dispositions within established governance workflows.
- Current AppSec Advisory procedures use ServiceNow APM tasks, TDAR information, assessment compliance information, and vulnerability status to determine production readiness.
Portfolio Oversight
- Maintain visibility into the security posture of the AI application portfolio.
- Identify systemic vulnerabilities, recurring control gaps, and emerging AI security risks.
- Develop portfolio-level reporting and metrics for leadership.
- Support prioritization of high-risk AI applications and vulnerabilities based on business criticality, exposure, and security risk.
Stakeholder Partnership
- Act as the primary interface between EVM/Application Security and AI application teams.
- Partner with AI engineering, architecture, technology risk, development, and security teams to resolve security issues.
- Translate complex AI and application-security risks into actionable guidance for both technical teams and leadership.
- Support AppSec office hours and other advisory channels used to help application teams interpret security requirements. The existing EVM Q&A Office Hour: AppSec, Container Sec, Infrastructure Sec is explicitly designed to answer AppSec questions and provide guidance on standards and compliance requirements.
Preferred Qualifications
- Strong experience in Application Security, vulnerability management, DevSecOps, or cybersecurity advisory.
- Working knowledge of SAST, SCA, DAST, penetration testing, APIs, cloud-native applications, and secure SDLC practices.
- Knowledge of AI/ML and Generative AI security risks, LLM architectures, model integrations, and AI adversarial testing.
- Familiarity with frameworks such as OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, MITRE ATLAS, and NIST AI RMF.
- Ability to interpret vulnerabilities and technical security findings in the context of application architecture and business risk.
- Strong stakeholder-management skills with the ability to communicate technical risk to engineering teams and senior leadership.
