Staff Security Engineer (AI Enablement)

Join Trustly's Security & IT team as a Staff Security Engineer focused on AI Enablement. In this role, you will be at the forefront of securing Trustly's AI-native transformation, ensuring that AI systems are built, deployed, and governed safely. You will define security standards and controls for AI systems, assess and mitigate risk, and build the tooling and frameworks that allow Trustly to move fast with AI without compromising security.

• Definir los estándares de seguridad y controles para los sistemas de IA, trabajar en colaboración con el equipo de habilitación de IA para evaluar y mitigar riesgos.
• Ser responsable de la evaluación de seguridad y la gestión de riesgos para los sistemas de IA y LLM de Trustly, incluyendo Claude y las implementaciones del servidor MCP.
• Construir y mantener herramientas para la supervisión de seguridad específica de la IA, detectando comportamientos anómalos del modelo, accesos no autorizados a datos y violaciones de políticas en tiempo real.
• Strong security engineering fundamentals — experienced in threat modeling, secure design review, penetration testing, and building security monitoring infrastructure
• 8+ years of security engineering experience, with at least 2-3 years focused on AI/ML security, LLM security, or security for data-intensive systems
• Track record of operating at Staff+ IC scope — driving security decisions that span multiple teams, influencing architecture through technical credibility rather than authority
• Familiarity with MCP (Model Context Protocol) architecture, LLM orchestration frameworks, and agentic AI deployment patterns — you can reason about security at the level of individual tool calls and context windows
• Deep, hands-on understanding of the AI security threat landscape — prompt injection, jailbreaking, data poisoning, model exfiltration, insecure agentic tool use, and MCP-specific attack surfaces
• Excellent communicator — able to explain novel AI security risks clearly to both technical and non-technical audiences, and to earn trust with engineering teams as a partner rather than a gatekeeper