Role description

AI Security Engineer in Residence

Version 2, October 2026

Purpose

The AI Security Engineer in Residence (SEIR) is a role contracted by an ecosystem organisation and supported by grant funding, designed to strengthen the security and resilience of an open source ecosystem in the context of increasingly capable AI models and tools.

This role exists to help an ecosystem prepare for and respond to:

• increased volumes of AI-generated vulnerability reports, including both low-quality and credible reports,
• faster and more scalable AI-assisted vulnerability discovery,
• a growing likelihood of AI-enabled attacks on software, infrastructure and maintainers,
• the need for trusted, rapid and practical security support for critical ecosystem projects.

The role combines hands-on security engineering, trusted maintainer support and ecosystem-level coordination. It also includes a Rapid Response function to help the ecosystem react quickly when urgent security issues arise.

Role summary

The SEIR is embedded in service of a specific open source ecosystem and is expected to be identified, engaged and supported by that ecosystem using grant funding. The engineer works with maintainers, ecosystem stewards and a broader cross-ecosystem peer group to identify, validate, prioritise and help remediate security issues that present meaningful risk.

The role is not intended to act as an external auditor or enforcement function. It is designed to provide practical capacity: helping projects find and fix important vulnerabilities, accelerating response where time matters, improving the quality of security engagement with maintainers, and leaving behind reusable practices and playbooks that strengthen the ecosystem over time.

The engineer is expected to prioritise engagement with projects in the assigned ecosystem and to participate as part of a virtual team collaborating with peer practitioners across other open source ecosystems.

Objectives

1. Reduce systemic security risk within the ecosystem.
2. Improve the speed and quality of vulnerability triage, validation and remediation.
3. Support maintainers in handling credible findings and increased AI-related security pressure.
4. Provide Rapid Response capacity for urgent, high-risk security situations.
5. Establish practical, repeatable workflows and playbooks that remain useful beyond the term of the engagement.
6. Contribute lessons learned and effective practices to a shared cross-ecosystem effort.
7. Enhance project visibility and long-term financial sustainability through consistent reporting of impact metrics and real-world case studies.

Core responsibilities

1. Identify and validate meaningful security issues

Conduct or coordinate proactive security review of ecosystem projects using appropriate human-led and AI-assisted methods. Validate findings before escalation, distinguish real vulnerabilities from false positives or low-signal outputs, and focus effort on issues that matter in practice.

2. Support remediation and responsible handling

Work with maintainers to explain findings clearly, assess severity in context, recommend or help develop fixes, and support responsible disclosure and release coordination as needed.

3. Provide Rapid Response support

Act as a trusted technical resource when urgent security issues arise, including helping maintainers and ecosystem leads assess exploitability, prioritise action, coordinate short-term mitigation and manage surges in AI-generated reports.

4. Build maintainer trust and ecosystem capacity

Engage maintainers constructively and respectfully, with an emphasis on usable guidance, collaborative problem-solving and long-term improvement in ecosystem security practices.

5. Help develop practical operating methods, tools, prompts and threat models

Document and refine repeatable workflows for triage, outreach, disclosure, prioritisation and Rapid Response so the work can scale and continue beyond a single individual. Develop tools and prompts to help across the local and regional communities. Proactively expand threat model coverage to encompass critical projects across the open source ecosystem.

6. Contribute to cross-ecosystem collaboration

Participate in regular coordination with peers in other ecosystems, share lessons learned and contribute to a broader body of practice for securing open source ecosystems against evolving AI-enabled threats.

Ways of working

The engineer is expected to operate in a manner that is:

• Ecosystem-first, prioritising the needs of projects and maintainers in the assigned ecosystem,
• high-signal, emphasising validated and actionable work over raw finding volume,
• collaborative, working with maintainers as partners,
• practical, focused on remediation and risk reduction,
• discreet, handling sensitive information responsibly,
• repeatable, documenting methods and decisions so the work can be sustained,
• cross-ecosystem-minded, contributing to a shared virtual team and common learning.

Expected deliverables

Deliverables vary by ecosystem and contract period, but are generally expected to include:

• community-facing security guidance, standards or recommended practices that help improve ecosystem safety,
• a defined point-of-contact function for inbound security reports from clearing-houses and related channels, including triage and coordination support for affected projects,
• documented methods and lessons learned as a contribution to the broader SEIR virtual team,
• tools, prompts and supporting workflows that improve the effectiveness of discovery, triage, remediation and response across both the local ecosystem and the broader cross-ecosystem effort,
• consistent reporting of metrics to highlight outcomes and overall effectiveness of the SEIR initiative,
• detailed real-world case studies illustrating practical outcomes and broader ecosystem impact.

Expected outcomes

Success in this role is measured by meaningful improvement in ecosystem security posture and response capacity, including:

• important vulnerabilities identified and responsibly addressed,
• faster and higher-quality triage and remediation,
• stronger maintainer support and security collaboration,
• better handling of AI-generated vulnerability intake,
• improved readiness for urgent security issues,
• durable playbooks and practices that outlast the engagement,
• stronger coordination and learning across ecosystems.

Metrics

The cross-ecosystem virtual team identifies and refines metrics to measure impact and progress. Candidate metrics include:

• projects engaged,
• validated findings,
• time to triage,
• time to remediation or mitigation,
• number and nature of Rapid Response engagements,
• maintainer response and participation,
• operational artifacts produced,
• evidence of improved ecosystem security practice or readiness,
• threat model coverage among critical projects.

Reporting and coordination

The engineer typically reports to or coordinates with the ecosystem organisation or other designated ecosystem stakeholders responsible for the engagement. Alpha-Omega serves as the funder, driven by a vision for the effective utilisation of the grant, while the ecosystem is responsible for identifying the individual, managing the engagement locally and ensuring the role is positioned for success.

The role is expected to include:

• regular progress reporting,
• escalation of risks or blockers through agreed channels,
• coordination with maintainers and ecosystem leads,
• participation in cross-ecosystem virtual team meetings,
• coordination on inbound security reports and other matters arising through the broader Alpha-Omega-supported initiative.

Boundaries

Unless explicitly agreed otherwise, this role is not intended to:

• replace maintainer ownership of projects,
• serve as the sole security or incident response function for the ecosystem,
• guarantee comprehensive review of the entire ecosystem,
• disclose unvalidated findings,
• optimise for vulnerability counts over trust and usefulness,
• make unilateral governance decisions on behalf of the ecosystem.

Required profile

A qualified SEIR typically brings:

• strong software security engineering judgment,
• experience validating and prioritising vulnerability findings,
• the ability to work constructively with open source maintainers,
• fluency with AI-assisted workflows and their limitations, or a willingness to learn and develop this skill alongside the broader virtual team,
• strong written communication and responsible disclosure judgment,
• discretion in handling sensitive security information,
• the ability to work independently while contributing effectively to a distributed peer team.

Term

The ecosystem organisation and the individual serving in the role agree the term, expected level of effort, reporting cadence and review points for the engagement.

As a default expectation for grant-supported work, the engagement period is typically six months, with the precise duration set based on ecosystem need, scope and available funding. Because the role is intended to provide practical capacity in a changing threat environment, the ecosystem should be positioned to identify and engage someone who can start quickly once funding is confirmed.

In short

The AI Security Engineer in Residence is a grant-supported role embedded in support of an open source ecosystem to help identify, validate, prioritise and remediate meaningful security issues in the age of highly capable AI. The role combines practical security engineering, trusted maintainer engagement, Rapid Response support and cross-ecosystem collaboration. Its purpose is not only to find issues, but to improve the ecosystem's ability to respond to them effectively and sustainably.

Contact the programme