Job description

At Fluor, we are proud to design and build projects and careers. We are committed to fostering a welcoming and collaborative work environment that encourages big-picture thinking, brings out the best in our employees, and helps us develop innovative solutions that contribute to building a better world together. If this sounds like a culture you would like to work in, you’re invited to apply for this role. Job Description The AI Reviews / DevSecOps Specialist supports secure delivery of traditional and AI-enabled solutions by performing application security reviews, AI security assessments, and DevSecOps control validation before production use. The role works closely with Security Operations, AI Security and Privacy Architecture, developers, internal business customers, platform teams, and vendors to identify risks early, verify remediation, and produce defensible evidence for governance and audit needs. • Perform security reviews for AI-enabled applications, copilots, agents, integrations, and supporting APIs before production deployment. • Execute AI-specific security checks, including prompt-injection testing, jailbreak resistance review, tool-misuse assessment, sensitive-data leakage testing, grounding/source validation, and abuse-case review. • Review remediation plans, validate fixes, and document residual risk, compensating controls, or waiver/risk-register inputs when required. • Partner with development and platform teams to embed secure coding, threat modeling, CI/CD security gates, SBOM/SCA review, and secure deployment practices into delivery workflows. • Assess third-party and internally developed AI solutions for data handling, access control, logging, retention, model interaction, and integration risks. • Maintain reusable review checklists, evidence templates, testing playbooks, and operating procedures for AI and application security assessments. • Stay current with AI security threats, application vulnerabilities, OWASP guidance, and DevSecOps tooling trends, and translate lessons learned into practical review criteria. Basic Job Requirements • Accredited four (4) year degree or global equivalent in applicable field of study and five (5) years of work-related experience or a combination of education and directly related experience equal to nine (9) years if non-degreed; some locations may have additional or different qualifications in order to comply with local requirements • Ability to communicate effectively with audiences that include but are not limited to management, coworkers, clients, vendors, contractors, and visitors • Job related technical knowledge necessary to complete the job • Ability to learn and apply knowledge of applicable local, state/province, and federal/national statutes and guidelines • Ability to attend to detail and work in a time-conscious and time-effective manner Other Job Requirements • Ability to support a globally distributed team and coordinate reviews across time zones as needed. • Ability to document technical findings clearly enough for developers, IT leaders, risk owners, and non-technical stakeholders. • Ability to handle sensitive application, architecture, vendor, and security assessment information appropriately. • Other duties as assigned. Preferred Qualifications • Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field. • Experience performing application security reviews or DevSecOps engineering in enterprise environments. • Hands-on experience with SAST, DAST, SCA/dependency scanning, secrets scanning, IaC scanning, API security testing, and CI/CD security controls. • Familiarity with AI security concerns such as prompt injection, jailbreak techniques, insecure tool use, data leakage, model/agent governance, and AI system abuse cases. • Working knowledge of OWASP Top Ten, OWASP API Top Ten, and emerging AI security guidance such as OWASP Top 10 for LLM Applications. • Ability to read architecture diagrams, understand authentication/authorization flows, and identify practical security gaps in application design. • Proficiency with scripting or programming languages such as Python, JavaScript, Java, PowerShell, or similar is a plus. • Strong written communication, note-taking, prioritization, and collaboration skills. We are an equal opportunity employer. All qualified individuals will receive consideration for employment without regard to race, color, age, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, genetic information, or any other criteria protected by governing law. Benefits Statement: Fluor is proud to offer a comprehensive benefits package designed to promote employee health, wellness, and financial security. Our offerings include medical, dental and vision plans, EAP, disability coverage, life insurance, AD&D, voluntary benefit plans, 401(k) with a company match, paid time off (personal, bereavement, sick, holidays) for salaried employees, paid sick leave per state requirement for craft employees, parental leave, and training and development courses. Market Rate Statement: The market rate for the role is typically at the mid-point of the salary range; however, variations in final salary are determined by additional factors such as the candidate’s qualifications, relevant years of experience, geographic location, internal pay equity, and prevailing market conditions for the specific role. Notice to Candidates: Background checks are carried out as part of any conditional offer made, including (but not limited to & role dependent) education, professional registration, employment, references, passport verifications and Global Watchlist screening. To be Considered Candidates: Must be authorized to work in the country where the position is located. Salary Range: $83,000.00 - $154,000.00

Requirements

Must-haves

Perform security reviews for AI-enabled applications, copilots, agents, integrations, and supporting APIs before production deployment.
Execute AI-specific security checks, including prompt-injection testing, jailbreak resistance review, tool-misuse assessment, sensitive-data leakage testing, grounding/source validation, and abuse-case review.
Review remediation plans, validate fixes, and document residual risk, compensating controls, or waiver/risk-register inputs when required.
Partner with development and platform teams to embed secure coding, threat modeling, CI/CD security gates, SBOM/SCA review, and secure deployment practices into delivery workflows.
Assess third-party and internally developed AI solutions for data handling, access control, logging, retention, model interaction, and integration risks.
Maintain reusable review checklists, evidence templates, testing playbooks, and operating procedures for AI and application security assessments.
Stay current with AI security threats, application vulnerabilities, OWASP guidance, and DevSecOps tooling trends, and translate lessons learned into practical review criteria.
Basic Job Requirements
Ability to communicate effectively with audiences that include but are not limited to management, coworkers, clients, vendors, contractors, and visitors
Job related technical knowledge necessary to complete the job
Ability to learn and apply knowledge of applicable local, state/province, and federal/national statutes and guidelines
Ability to attend to detail and work in a time-conscious and time-effective manner
Other Job Requirements
Ability to support a globally distributed team and coordinate reviews across time zones as needed.
Ability to document technical findings clearly enough for developers, IT leaders, risk owners, and non-technical stakeholders.

Nice-to-haves

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
Experience performing application security reviews or DevSecOps engineering in enterprise environments.
Hands-on experience with SAST, DAST, SCA/dependency scanning, secrets scanning, IaC scanning, API security testing, and CI/CD security controls.
Familiarity with AI security concerns such as prompt injection, jailbreak techniques, insecure tool use, data leakage, model/agent governance, and AI system abuse cases.
Working knowledge of OWASP Top Ten, OWASP API Top Ten, and emerging AI security guidance such as OWASP Top 10 for LLM Applications.
Ability to read architecture diagrams, understand authentication/authorization flows, and identify practical security gaps in application design.
Proficiency with scripting or programming languages such as Python, JavaScript, Java, PowerShell, or similar is a plus.
Strong written communication, note-taking, prioritization, and collaboration skills.
To be Considered Candidates: Must be authorized to work in the country where the position is located.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aici/cdapillmpythonjavascriptjava

Platform: eightfold
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Paid Time Off

Parental Leave

Wellness