Senior Product Security Engineer — AI/ML Security
Secure AI-enabled products before buyers, attackers, or auditors find the gaps.
Secure AI-enabled products before buyers, attackers, or auditors find the gaps. I turn adversarial findings into controls, retests, and evidence buyers can trust — across RAG/agent abuse testing, evidence engineering, and enterprise product-security programs.
What I Deliver
What you walk away with
AI Risk Findings
Documented model, agent, RAG, data-flow, and product-security risks.
Threat & Trust Map
Trust boundaries, abuse paths, AI components, data flows, and exposed surfaces.
Architecture Proof
Diagrams and notes your engineering, security, and buyer-review teams can use.
Control Recommendations
Prioritized controls mapped to findings, feasibility, ownership, and impact.
Buyer-Ready Proof
Security posture artifacts for enterprise review, RFPs, questionnaires, and trust discussions.
Remediation Backlog
Engineering-ready work items with severity, owner, acceptance criteria, and retest notes.
How I Help
What I can scope for your team
AI Product Security Assessment
2-4 WEEKS
Review AI features, RAG, agents, data flows, logging, tenancy, and customer-facing product surfaces.
AI Red Team & Adversarial Testing
3-6 WEEKS
Test prompt injection, RAG abuse, agent/tool misuse, jailbreaks, and unsafe workflow paths.
Agentic Workflow Security & Hardening
3-6 WEEKS
Lock down tool permissions, approval gates, human review, audit logs, and delegated actions.
Secure SDLC Sprint
3-6 WEEKS
Review SaaS architecture, APIs, authz, tenancy, admin surfaces, integrations, logging, and abuse paths.
AI Security Sales Enablement
2-4 WEEKS
Turn findings, controls, and proof into buyer-facing collateral for enterprise security review.
AI Security Maturity Benchmark
4-8 WEEKS
Build repeatable intake, triage, remediation tracking, governance proof, and executive reporting.
Selected proof
Selected projects from David Wolf's work
Confidential AI Automation Platform
Agentic Browser Security Assessment
A product-security assessment of browser trust boundaries, privileged pages, native bridges, script-injection persistence, credential surfaces, and native command dispatch.
Splunk
Splunk Product Security Program Buildout
Building a scalable, evidence-driven product security function for a global enterprise software platform.
Cornerstone OnDemand
Cornerstone FedRAMP Moderate ATO Security Controls
A control-architecture and evidence-readiness effort translating FedRAMP Moderate requirements into policy, standards, technical controls, operational procedures, and audit-ready proof.
Research & publications
Publications by David Wolf
Recent field notes
Recent AI security analysis by David Wolf
Public-safe editorial writing, technical analysis, and market-intelligence coverage.
1 / 6
All articles
Drag or use arrows