AI Security Officer

Sourcebooks is seeking an AI Security Officer to help our teams adopt AI tools and build AI-enabled solutions securely. You will partner with our Information Security Officer, IT, the AI team, Legal, and business owners to assess risk, set practical guardrails, and help good ideas move from pilot to production with confidence.

Reporting to the Sr. Manager, Security & Operations you will build and own our AI security review process, from intake through decision and reassessment. This is a hands-on individual contributor role for someone who enjoys both the technical work of security and helping colleagues work safely.

The location for this position can be hybrid or remote in New York or Naperville, Illinois or remote based in any of the following states: Arizona, Connecticut, Illinois, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, Montana, New Jersey, New York, Ohio, Oregon, Pennsylvania, Tennessee, Texas, Virginia, Washington, Washington D.C., and Wisconsin.

This an exempt salaried position with a range of $110,000 - $120,000/annually. We determine starting pay based on a thorough evaluation of job-related factors, including geographic location, market conditions, relevant experience, training, and education. This process ensures a fair and competitive salary that aligns with both the company and the candidate’s qualifications.

What you’ll do:

AI security review

- Build and improve the AI security review process, including intake forms, risk criteria, assessment templates, configuration standards, and review records. Align these with the ISO’s existing governance and compliance processes.
- Manage the ongoing AI review queue from intake through documented disposition. Prioritize requests by risk, coordinate required reviews, communicate approval conditions, and maintain an inventory of owners, approved uses, restrictions, and reassessment dates.
- Assess AI tools and own the management of their embedded and new features, plugins, connectors, APIs, and agents. Examine vendor evidence, prompt retention, model training use, deletion, data flows, and permissions; evaluate exposure to prompt injection, unsafe outputs, and unauthorized actions.
- Document inherent and residual risk, mitigating controls, remediation owners, and due dates. Recommend approval, conditional approval, or rejection; track findings until controls are verified or residual risk is accepted by authorized decision makers.
- Perform hands-on security validation with IT and solution owners. Review configurations and permissions, test misuse scenarios and access boundaries, and verify data protections, human approval, logging, and rollback before recommending release.
- Reassess approved capabilities when vendors, models, features, integrations, data access, or intended uses change. Check configuration drift and control effectiveness, follow corrective actions to closure, and confirm secure access removal and data handling at retirement.

Partnership and enablement

- Own the security controls for the Citizen Developer program. Review proposed data access and automated actions, explain security requirements, mitigating controls, and help teams resolve findings before pilots and production use.
- Work closely with the AI team to understand proposed use cases, business needs, and planned implementations.
- Serve as the security liaison between the AI team and IT, translating AI requirements into practical security controls, coordinating risk assessments and technical reviews, and helping resolve security issues throughout adoption and deployment.
- Develop and deliver practical AI security training and guidance for users, Citizen Developers, and administrators.
- Cover sensitive data, output verification, prompt injection, AI-enabled fraud, and incident reporting; use recurring findings to update training.

Incident readiness and reporting

- Maintain and exercise AI incident playbooks. Provide investigation and containment expertise during IT-led response, help business owners test fallback procedures, and incorporate lessons learned into controls and guidance.
- Report review volumes, turnaround, assessment coverage, overdue findings, and AI risk trends to the ISO and leadership. Maintain audit evidence, escalate unresolved risks, and recommend improvements based on review outcomes and control testing.

What you bring:

- 5+ years in cybersecurity, technology risk, GRC, or security engineering, plus practical experience assessing or securing AI tools or workflows.
- Experience with risk assessments, vendor reviews, and security control testing.
- Working knowledge of enterprise AI assistants, cloud and SaaS controls, identity and access management, APIs, and low-code or no-code platforms.
- Familiarity with ISO 27001 or NIST frameworks, including the NIST AI Risk Management Framework.
- The ability to explain risk in plain language and coordinate technical and business reviews.
- A relevant bachelor’s degree or equivalent experience.

Helpful Additional experience

- Citizen Developer governance, AI security testing, ISO/IEC 42001, or certifications such as CISSP, CISM, CISA, or CRISC.

Why Sourcebooks?
At Sourcebooks, we believe books change lives. As the fifth-largest U.S. publisher by print units sold, we connect authors and readers through an entrepreneurial approach informed by data and reader insights. Our work has earned recognition from Fast Company, Newsweek, Inc., and Publishers Weekly. Our books have reached more than 300 million lives, and we’re working to reach 300 million more.

Ready to apply:
Send your resume, salary requirements, and a cover letter sharing your relevant experience and why this role interests you. A cover letter is required for consideration.

Full-time employees are eligible for our comprehensive benefits program. Our range of benefits include, but are not limited to, Medical/Prescription drug insurance, Dental, Vision, Health Care/Dependent Care Flexible Spending Account, Health Savings Account, 401(k), Short and Long-Term Disability Insurance, Life/AD&D Insurance, & generous paid time off.

Sourcebooks values the array of talents and perspectives that a diverse workforce brings. All qualified applicants will receive consideration for employment without regard to race, national origin, religion, age, color, sex, sexual orientation, gender identity, disability, or protected veteran status.