AI Phone - Security & Privacy Engineer
Bjak · United States
Extracted from the posting
Design the security and privacy architecture for an AI-native phone, covering permission models, sandboxing, encryption and audit logging for AI agent access to user data and system services. Responsibilities include threat modeling, penetration testing and mitigating prompt injection and data exfiltration risks. Requires Android security, SELinux and Binder IPC experience.
About
We are reimagining the phone. AI phones need to be proactive, intuitive, intelligent and low cost. This is a mission critical for rest of the world to adopt intelligence.
There are over 5 billion people using everyday applications such as email, messaging, notes, tasks, and calendars, yet most are not AI-native. Our mission is to build proactive applications and devices that bring intelligence into daily conversations, coordination and workflows, with minimal prompting.
Focus: Designing and implementing the security and privacy architecture for the AI-native phone, ensuring AI agents can safely access user data, interact with applications, and execute actions across the operating system.
Unlike conventional mobile application security, this role needs to consider the additional risks introduced by AI agents having access to personal context, system services, and application-level actions.
Responsibilities
- Design the overall security and privacy architecture for the AI-native phone.
- Define permission models and access boundaries for AI agents interacting with user data and system services.
- Design secure mechanisms for AI access to messages, contacts, calendars, notifications, camera, microphone, location and other sensitive information.
- Implement appropriate sandboxing and isolation for agent execution.
- Define authentication, authorization and access-control mechanisms for AI tools and application integrations.
- Ensure users have control over what information AI can access and what actions it can execute.
- Implement audit logging and user-visible activity tracking for AI access and actions.
- Design secure storage, encryption, data retention and deletion mechanisms for personal data and memory.
- Identify and mitigate AI-specific security risks, including prompt injection, malicious applications, data exfiltration and unauthorized tool execution.
- Review Android permission models, privileged system access, SELinux policies and system-level security boundaries.
- Work closely with Android/AOSP, Agent Runtime, Context & Memory and Applied ML teams to ensure security is built into the architecture rather than added later.
- Conduct security assessments, threat modeling and penetration testing for system-level AI capabilities.
Requirements
- Strong experience in mobile security, Android security, application security or systems security.
- Deep understanding of Android security architecture, including application sandboxing, permissions, SELinux, Binder IPC and privileged system services.
- Experience designing authentication, authorization and access-control systems.
- Strong understanding of encryption, secure storage, key management and data protection.
- Experience with security threat modeling, vulnerability assessment and penetration testing.
- Understanding of privacy-by-design principles, data minimization and user consent.
- Ability to work across Android platform, backend and AI agent architectures.
Nice to have
- Experience with AOSP security customization or Android platform security.
- Experience securing system-level applications or privileged Android services.
- Experience with AI agent security, prompt injection, tool-use security and LLM data leakage.
- Experience with mobile device security, Trusted Execution Environment (TEE), hardware-backed keystores and secure boot.
- Experience with privacy engineering for products handling sensitive personal information.
- Experience building permission and approval systems for autonomous agents.
