Sr. AI & Agentic Security Architect - Cary, United States

As part of MetLife’s Global Security team, you’ll work alongside world-class experts to protect MetLife, our customers and our colleagues. The team is responsible for managing cybersecurity, IT risks and vulnerabilities, physical security, and more. In this fast-paced, mission-driven environment, you’ll join outstanding teammates to expand your skills, collaborate across the organization and implement innovative approaches to safeguard MetLife when it matters most. Ready to make an impact? Join us if you want to embrace the rapidly evolving environment and use transformative technology to integrate and build security into the foundation of key initiatives across MetLife.

• Build security controls that govern agent permissions, tool access boundaries, and inter-agent trust — preventing privilege escalation, unauthorized tool invocation, and unintended autonomous actions across agentic workflows.

• Define and operationalize threat models for LLM-based systems covering prompt injection (direct and indirect), insecure output handling, excessive agency, training data poisoning, and model misuse — aligned to OWASP LLM Top 10 and MITRE ATLAS.

• Own the architecture of the enterprise AI SPM capability — providing continuous visibility into the full AI asset inventory including models, agents, MCP servers, orchestrators, and tool registries, as well as risk posture and policy compliance status.

• Lead the technical design and implementation of Shadow AI Discovery capabilities — detecting unsanctioned AI tools, models, services, and agentic deployments across the enterprise through network telemetry, cloud resource scanning, API gateway analysis, and endpoint signals.

• Embed security controls and automated benchmarks into CI/CD pipelines across the AI development lifecycle — covering model training, fine-tuning, agent deployment, and inference stages.

• Serve as the enterprise-wide technical authority on AI and agentic security — setting standards, publishing architectural guidance, and reviewing AI system designs for security risk before production deployment.

• Partner with AI platform engineering, MLOps, DevOps, IAM, and Enterprise Architecture, Security Engineering and Regional teams to embed security into AI development practices from the ground up — without slowing delivery.

• 5-7 years of overall experience.
• Experience designing and implementing enterprise AI security, governance, and risk management programs.
• Hands-on experience implementing AI security controls, AI guardrails, AI application security, and AI asset discovery capabilities.
• Strong knowledge of AI security and risk frameworks such as NIST AI RMF, MITRE ATLAS, OWASP AI guidance, or equivalent industry standards.
• Experience securing AI applications, copilots, LLM-based solutions, agentic systems, or comparable AI technologies in cloud environments.
• Strong cloud and security architecture background with the ability to assess and mitigate AI-related risks.
• Ability to operate independently, influence technical decisions without direct authority, and communicate effectively with both engineering teams and executive stakeholders.

• AI Security Posture Management (AI-SPM)
• Shadow AI Discovery
• ISO/IEC 42001
• LangChain, LangGraph, AutoGen, CrewAI, Semantic Kernel, or similar frameworks
• MCP (Model Context Protocol) architecture and security implications
• Experience with agentic AI security assessments and threat modeling (e.g., MITRE ATLAS)

#LI-WRAPJOB 

The expected salary range for this position is $100,000 - $165,000. This role may also be eligible for annual short-term incentive compensation and stock-based long-term incentives. All incentives and benefits are subject to the applicable plan terms. 

Benefits We Offer About MetLife MetLife is an Equal Opportunity Employer. All employment decisions are made without regards to race, color, national origin, religion, creed, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity or expression, age, disability, marital or domestic/civil partnership status, genetic information, citizenship status (although applicants and employees must be legally authorized to work in the United States), uniformed service member or veteran status, or any other characteristic protected by applicable federal, state, or local law (“protected characteristics”).