About Casper Studios

We’re an AI services firm that helps companies figure out where and how to use AI. We’ve built Casper Studios to roughly 45 people, worked with 30+ clients, and done deals with some of the largest companies, PE funds, and model providers.

It all comes down to how we work with clients. Before we build anything, we listen, understand the business, and help them figure out the highest-leverage way to get started on their AI journey.

About the Role

We're hiring an AI Security & DevOps Engineer to own how Casper takes AI systems from prototype to production securely. This role will set and enforce the technical standard: threat models, secure defaults, authentication and secrets patterns, CI/CD gates, and the agent-specific controls that AI systems need and traditional security programs don't cover. In parallel, this role will own the client security conversation: engaging their security team early, translating their requirements into what we build, and producing the evidence that gets an enterprise deployment approved.

The AI Security & DevOps Engineer will work across every engagement rather than sitting on. Our clients are largely regulated enterprises on Microsoft stacks, so the work spans identity, cloud, data protection, and the newer surface of agents, tools, and connectors. This position will be the person who knows the difference between a proof of concept and a production system in a bank, scales the rigor accordingly, and decides what ships.

What You’ll Do

• Own Casper's dev-to-production security standard and make it something engineers actually use

• Define and run the security gate in our delivery process: threat models, design reviews, and the call on what ships

• Harden what we build - identity and authentication, secrets management, data protection, egress controls, and the agent surface: prompt injection, tool and connector permissioning, untrusted input in agent loops, MCP auth

• Own the platform work security depends on: CI/CD, automated scanning and review across our repos, infrastructure-as-code, environment and access management, logging and telemetry

• Audit our own repos and internal systems, and fix what you find

• Lead the client security conversation - engage their security team early, extract requirements, map approved and unapproved vendors, and produce the threat models and evidence packs that clear review the first time

• Set our point of view on preferred vendors for auth, secrets, telemetry, and scanning so engagements stop relitigating the same decisions

• Feed security into scoping - realistic timelines and a production roadmap that accounts for how long validation takes

• Raise the security bar across engineering through review, pairing, and written standards

What You’ll Bring

• Deep hands-on application and product security experience - you've threat modeled, found real vulnerabilities, and written the fixes yourself

• Real DevOps and platform depth: CI/CD, infrastructure-as-code, cloud (Azure especially, plus AWS/GCP), secrets management, and observability. You've built the pipeline, not just reviewed it

• Identity and authentication depth - OAuth/OIDC, SSO/SCIM, RBAC, conditional access - with working knowledge of Microsoft Entra

• Demonstrated LLM and agent security expertise: prompt injection, excessive agency, tool and connector permissioning, insecure output handling, retrieval abuse, and AI supply chain risk

• Secure SDLC in practice: SAST/DAST/SCA, dependency and supply chain controls, and automated review engineers don't route around

• The judgment to right-size controls to the stage and the stakes

• Client-facing credibility - you can hold a room with an enterprise security team and translate risk into terms an executive can decide on

• AI-native mindset - you use modern AI tooling daily with customized workflows. You can't threat model an agent system you've never built with

• High agency and strong writing. The standards, evidence packs, and memos are yours, and they need to be good enough that busy people act on them

Nice to Haves

• Regulated-industry exposure - financial services, healthcare, or another environment where security review is genuinely adversarial

• Consulting, agency, or forward-deployed background where you earned trust with a client's security org rather than inherited it

• Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, or ISO 42001

• SOC 2 or ISO 27001 experience - useful context, not the job

• AI red teaming, adversarial testing, or abuse-case analysis

You Might Be A Fit If

• You've been a first security hire and built the function from nothing

• You're an AppSec or platform engineer who went deep on LLM and agent security and now gets pulled into every AI review

• You've been the security lead on client-facing delivery and know how to get a skeptical enterprise security team to yes

• You've owned production readiness for systems that had to clear a real audit

• You want standard-setting authority and are comfortable being the person in the company who does what you do

Why This Role Is Hard To Fill

Most people land on side of a line. GRC and compliance people can run a program but can't read the code or fix what's broken in it. Strong AppSec engineers often haven't been client-facing and won't hold up in an enterprise security review. Traditional DevOps engineers know the pipeline but not the AI-specific attack surface. And people from large in-house security teams tend to bring processes that a services business moving at our pace can't absorb.

This person writes the hardening, owns the platform, and is persuasive in front of a client CISO.

The role is broad, so where you're coming from can be too

• What matters most: hands-on depth, sound judgment about risk, the credibility to hold the line, strong writing, and comfort building the system while the work is already happening.

Logistics

• Fully remote, US/Canada based, with occasional client travel. We have team members across North America and internationally, mostly overlapping North American time zones. Work when and where you want, as long as the work gets done

• Compensation calibrated to your location and seniority - we'll talk comp and align on specifics early

Benefits

• 🏥 Medical, Dental, and Vision Coverage: Comprehensive health benefits to keep you and your family healthy.

• 🌴 Flexible PTO: Take the time you need to relax and rejuvenate.

• 🚑 Health FSA/HSA: Manage out-of-pocket health expenses effectively.

• 🏥 Life Insurance: Providing peace of mind for you and your loved.

• Regulated-industry exposure - financial services, healthcare, or another environment where security review is genuinely adversarial
• Consulting, agency, or forward-deployed background where you earned trust with a client's security org rather than inherited it
• Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, or ISO 42001
• SOC 2 or ISO 27001 experience - useful context, not the job
• AI red teaming, adversarial testing, or abuse-case analysis