Who We Are:
Enhesa is the leading provider of regulatory and sustainability intelligence worldwide. As a trusted partner, we empower the global business community with the insight to act today and prepare for tomorrow to create a more sustainable future - positively impacting our environment, our health, our safety, and our future. Navigating the fast-changing compliance and sustainability landscapes, we help them understand not just what they should do (first) but also how to do it. Both in their unique business and anywhere in the world. Now and in the future.
Our Mission:
- Identify EHS requirements for the industry
- Provide EHS compliance tools to companies
- Advise companies in developing and implementing corporate EHS strategies
Enhesa’s core clients include Fortune 500 multinational companies.
As part of our highly dynamic team, we offer:
- A competitive salary package & benefits with a flexible home-working policy
- Work/life balance and a fast-paced and driven environment
- Accountability and pride for your projects
Overview of the position
Support the Enhesa’s cybersecurity infrastructure by implementing robust security controls, deploying innovative security solutions, and investigating security incidents. A key focus of this role is securing AI/ML systems and pipelines, assessing risks introduced by large language models and generative AI tools, and defining security standards for AI adoption across the organization. This role is pivotal in maintaining the security posture through meticulous incident analysis and effective mitigation strategies. Beyond technical responsibilities, the position requires excellent collaboration and communication with various departments to align security policies and procedures with overall business objectives and compliance regulations. The role works closely with AI, Application Engineering, and Cloud Platform teams to embed security throughout the software development lifecycle and cloud infrastructure environments. The successful candidate will provide guidance on secure design patterns, conduct comprehensive security reviews of application code, cloud architectures, and managed AI services, and support the responsible development, deployment, and operation of AI-powered features and products.
Main tasks and responsibilities
- Drive Corporate AI Security Strategy: Define, implement, and govern the security standards, policies, and frameworks for AI/ML adoption across all business units.
- Lead Cross-Functional AI Initiatives: Act as the primary security partner for Platform, Application Engineering, and Product teams to support the responsible development and deployment of AI-powered features.
- Coordinate and Mentor Security Teams: Champion security culture by coordinating activities with Tech Leads, Engineering Managers, and the Security Champions network, providing guidance on secure design patterns for AI workloads.
- Oversee MLSecOps and SSDLC Integration: Architect and enforce the integration of advanced security controls, automated testing, and vulnerability management within CI/CD pipelines, DevSecOps, and MLSecOps workflows.
- Manage AI Risk and Threat Modeling: Conduct comprehensive security architecture reviews and risk assessments focusing on Large Language Models (LLMs) and Generative AI, mitigating risks like prompt injection, data poisoning, and model supply chain vulnerabilities (OWASP LLM Top 10).
- Incident Response Leadership: Lead investigation, mitigation, and recovery efforts for complex security incidents, with a specialized focus on threats targeting AI infrastructure, inference endpoints, and managed cloud AI services (e.g., Azure OpenAI, AWS Bedrock)
- Continuous Security Evolution: Monitor emerging cybersecurity trends, adversarial ML tactics, and global compliance regulations to preemptively evolve Enhesa’s security infrastructure against future vectors.
Key requirements
Education Level
Bachelor’s or advanced degree in computer science, artificial intelligence, mathematics, or related field or professional cybersecurity certifications in lieu of a formal degree.
Experience
At least 3 years of experience as cybersecurity professional, with at least 3 year in AI/ML security, LLM security, or security for AI-driven systems
Technical Skills:
- Application Security (AppSec) and Secure Software Development Lifecycle (SSDLC): familiarity with integrating security practices into CI/CD pipelines, code review processes, DevSecOps and MLSecOps workflows.
- OWASP Top 10 and OWASP LLM Top 10: solid understanding of common web application vulnerabilities and their AI/LLM-specific equivalents (e.g. prompt injection, insecure output handling, model supply chain risks).
- AI/ML Security: understanding of threat vectors specific to AI systems, including adversarial attacks, data poisoning, model inversion, and securing inference endpoints.
- Knowledge of networks (TCP/IP, LAN/WAN) Must possess a solid understanding of networking basics, including TCP/IP protocols, and the configuration and operation of both Local Area Networks (LAN) and wide Area Networks (WAN). Awareness of how these networks facilitate communication and the potential security implications is essential.
- Basic familiarity with the OSI (Open Systems Interconnection) model, including the understanding of its seven layers and how they contribute to network communications and cybersecurity practices.
- Security protocols, for example: (HTTPS, DNS, SMTP, FTP, SSH).
- Firewalls (IDS/IPS) familiar with the concepts and purposes of these tools.
- Understanding of information security principles, such as confidentiality, integrity, and availability.
- Familiarity with operating systems, especially Windows, Linux or Unix, and MacOS.
- Knowledge and familiarity with incident investigation and response processes.
- Specific Knowledge and Skills such as programming languages (Python, PowerShell); familiarity with API security testing and secure coding practices in web application stacks
- Knowledge of securing cloud environments (AWS, Azure, GCP), including experience securing AI/ML workloads and managed AI services (e.g. Azure OpenAI, AWS Bedrock, GCP Vertex AI)
- Familiarity with concepts like IAM (Identity and Access Management), encryption in transit and at rest, and shared responsibility models.
- Understanding of securing virtual machines and containerized environments.
Certifications
At least one AI security certification is required, such as: AAISM (Accredited AI Security Manager) or CompTIA SecurityAI+ (SecAI+). Other relevant certifications (e.g. CISSP, CEH, CCSP) are a plus.
Other Skills:
- Any other core skills to bring to the team are a huge plus, such as front-end development, experience administering cloud systems, deploying serverless cloud technology, deep Linux knowledge, etc.
- Fluency in English. Any additional language skills are an asset.
- In order to fit in Enhesa’s collaborative and international environment, creativity, dynamics, and ability to work independently yet transparently towards colleagues.
- Strong teamwork skills, both with colleagues as well as with external partners.
- Both individual and team problem-solving skills are crucial in this position.
If you are ready to join our journey, please apply!
Equal Opportunity Employer
Enhesa is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or any other legally protected characteristic.
