Role Description EMCOR Group, Inc. seeks an AI Security Engineer who will be responsible for securing the organization’s artificial intelligence capabilities—including GenAI systems, ML pipelines, model hosting, AI integrations, and AI-enabled business processes—through a combination of security architecture, governance, risk management, and hands-on engineering. This role designs and implements security controls to reduce risks such as prompt injection, data leakage, model exfiltration, supply-chain compromise, unauthorized use, and AI-driven abuse, while enabling safe adoption across the enterprise. - Adopt and maintain the Enterprise AI Security Reference Architecture - Establish security patterns and guardrails for AI use cases including approved data sources, allowed tools, etc. - Conduct threat modeling for AI systems and integrations and translate threats into technical controls - Operationalize AI governance with EMCOR Legal and Risk - Work with EMCOR Security Governance, Risk and Compliance (GRC) to maintain the AI risk assessment process - Implement and maintain controls to prevent data leakage and sensitive information exposure in AI prompts, outputs, logs, and training sets - Work with EMCOR Security Identity and Access Management (IAM) and GRC to deploy and tune protections like DLP, data classification, prompt and response filtering, RAG hardening and model endpoint security - Integrate and maintain AI security testing capabilities such as prompt injection, model behavior evaluations, adversarial testing, etc. - Work with EMCOR Security Operations to define and implement logging and monitoring requirements, create detection use cases, and playbooks for AI related incidents - Assist with AI vendor and cloud services assessments Qualifications - Seven years minimum experience in cybersecurity, security engineering and security architecture - Three years minimum experience securing cloud platforms, APIs, and CI/CD - Working knowledge of AI/ML concepts - Experience with security monitoring and detection, and incident response - CISSP, CCSP, or GIAC or equivalent certification preferred - Ability to effectively communicate and interact with personnel at all levels - Must be capable of delivering a very high level of customer service Benefits - Comprehensive benefits package including medical, dental, and vision coverage - Health savings and flexible spending accounts - Life insurance and disability coverage - 401(k) Savings Plan - College Coach and employee assistance program Compensation - Compensation Range: $134,000 - $171,000 - This position is bonus eligible

• Advise security and technical clients on storytelling and market navigation. • Build credibility with key audiences. • Shape strategy and pressure-test messaging. • Build reporter relationships and drive execution across various projects such as launches and thought leadership.

• Lead status reporting and executive communications, producing clear, executive-ready updates • Manage the coordination of deliverables across multiple P&T priority programs • Drive cross-functional execution and alignment, ensuring dependencies, prerequisites, and critical deliverables are identified, tracked, and delivered on time • Manage financial planning and tracking across security workstreams • Coordinate delivery across internal teams, product teams, vendors, and service providers • Facilitate meetings, driving accountability, and ensure clear documentation of actions, timelines, and outcomes • Proactively identify and escalate risks, gaps, and delivery blockers

• Lead client engagements and project execution providing information security consultation and assessment services, helping our clients meet their compliance obligations by evaluating their business, technology, and operations against industry security standards • Educate, mentor, advise, and share your expertise with clients and colleagues to aid in making decisions on topics like Artificial Intelligence, organizational security strategy and services scope as well provide consultative guidance on complex projects • Providing clear, organized findings and recommendations to clients and tracking progress towards resolution and compliance • Consult/advise with C-level Security Leaders (CISO, CSO, CIO, etc.) and the Board of Directors with our most valued and strategic clients • Develop strategic, operational, and tactical recommendations tailored to each client with the intent to improve a client’s security posture and compliance position • Create detailed strategic security roadmaps with short-term, mid-term, and long-term goals that prioritize remediation recommendations and address all instances of non-compliance with applicable regulatory, statutory, contractual, and organizational obligations • Lead large security engagements in concert with other cybersecurity practices and Presidio teams • Develop security policies, standards, and procedures that are custom-tailored to each client’s unique culture, security goals, and organizational objectives using industry best practices and compliance requirements • Review, analyze, and assess key factors, including inherent risk, mitigating controls, business impact, likelihood and other key elements to determine organizational security risk • Ensure and assess client alignment to, and/or compliance with, applicable regulatory, federal, state, local, contractual, and organizational requirements and best practices standards such as ISO 27001, NIST Cyber Security Framework (CSF), PCI DSS, HIPAA, FERPA, NIST 800-171, CMMC, etc. • Work closely with organizations to conduct security program development by establishing the foundation for a best of breed security program architecture reference model using industry frameworks and standards such as ISO 27001, NIST 800-53, NIST CSF, etc. • Work with other seasoned Principal Security Consultants in a collaborative setting to support and assist on the execution and delivery of key services such as Cloud Governance, Advisory Services, security program development, documentation review, and security consulting services • Execute tabletop exercises after collaborating with client stakeholders to select the scenario then create an After-Action Report • Deliver PCI Advisory Services, including PCI Gap Analysis, SAQs, ROCs and AOCs • Deliver CMMC Advisory Services, including CMMC Readiness Assessments • Assist leadership in cybersecurity administrative functions, such as documentation maintenance, documentation creation, peer review, and other internal cybersecurity activities