Description

Key Responsibilities

AI Usage Visibility and Discovery

• Assess UCOP's current security tools and configuration to identify AI monitoring gaps and what is needed to close them.
• Configure cloud access security broker (CASB) and related capabilities to discover and classify sanctioned and unsanctioned AI applications, model providers, and MCP servers.
• Establish usage baselines for approved enterprise AI tools to identify unusual activity.
• Use data loss prevention and data security capabilities to identify sensitive data flowing into AI tools.

Agents, Connectors, and MCP Connections

• Inventory AI agents, OAuth-connected apps, connectors, and MCP connections that touch UCOP data, including owner, permissions, and approval status.
• Develop policies and alerts for high-risk patterns such as over-permissioned connectors, unapproved third-party AI apps, and personal AI accounts connecting to UCOP data.
• Monitor UCOP AI agents for risky configurations, data access, and behavior, in line with the UCOP Agentic AI Guardrails.

Detection, Alerting, and Response

• Develop detections, alerts, and hunting queries for AI-related risks such as data exfiltration, prompt injection, and anomalous agent activity.
• Integrate audit and usage logs from enterprise AI platforms, where feasible, to centralize monitoring.
• Partner with UCOP Security on triage and response runbooks defining severity, escalation, and actions per alert type.
• Design monitoring that respects UC privacy requirements, including the UC Electronic Communications Policy, by favoring risk signals and metadata over content review.

Request Research, Risk Documentation, and Reporting

• Research incoming requests for new AI tools, agents, connectors, and MCP servers, assess security risks, and recommend approval conditions.
• Document risks, controls, and recommended practices aligned with the UCOP AI Acceptable Use Standard, the Agentic AI Guardrails, and UC policy IS-3.
• Report on AI usage, risk trends, and open issues for security, program, and leadership audiences.

Minimum Qualifications

• Bachelor's degree in Information Security, Computer Science, or a related field, or equivalent experience.
• Three or more years of security engineering, security operations, or cloud security experience in an enterprise environment.
• Hands-on experience with CASB, SIEM, and data loss prevention tools, including app discovery, policies, and alerts.
• Experience writing detection and hunting queries, and scripting (for example, Python or PowerShell) for automation, log analysis, and API integrations.
• Working knowledge of identity and access management, including OAuth consent, application permissions, and service accounts.
• Understanding of AI security risks such as data leakage, prompt injection, over-permissioned agents and connectors, and shadow AI.
• Strong written communication skills, including documenting risks, controls, and runbooks for varied audiences.
• Ability to work independently and collaboratively in a remote, cross-functional environment.

Preferred Qualifications

• Experience with Microsoft security tools such as Microsoft Defender and Microsoft Purview.
• Experience securing AI agents and integrations, such as MCP servers, connectors, or AI APIs.
• Familiarity with admin, audit, and compliance features of Microsoft 365 Copilot, ChatGPT EDU, or Box AI.
• Familiarity with AI risk frameworks such as the NIST AI RMF or the OWASP Top 10 for LLM Applications

Key Skills

Education

Bachelor's degree