About Norm
Norm builds AI-native professional services firms and the technology that powers them. Our mission is to help expert professionals deliver better work at greater scale.
Developing the technology and the firms together lets us rethink how work gets done, how teams operate and what clients can expect. Professional judgment and experience guide what we build, while advances in the technology expand what our firms can deliver. Our shared agentic platform connects that progress across teams and services.
Founded in 2023, Norm brings together experts across engineering, research, product, design and professional practice. Our legal and compliance platform serves institutions representing more than $35 trillion in combined assets under management.
Norm also powers Norm Law, LLP, an affiliated AI-native law firm whose attorneys advise leading institutions on complex corporate matters.
AI Fluency:
Norm prefers all team members to be fluent in AI. Successful candidates actively use AI in their day-to-day work to support thinking, creation, and problem-solving. They use it to improve the quality and speed of their work and to continuously refine how work gets done end-to-end.
Candidates should be prepared to demonstrate and discuss their AI usage throughout the interview process, including concrete examples of tools, workflows, and outcomes. We look for practical, hands-on experience, not theoretical familiarity.
This Role:
We’re hiring AI Security Engineers to build automated, AI-driven systems that find, prioritize, and fix security weaknesses faster than attackers can exploit them.
You’ll work across the full lifecycle, from discovery and threat modeling through remediation and response, and go deep in either offensive research or defensive operations based on your strengths. You’ll report to the Chief Security Officer and work closely with Engineering.
What You’ll Do:
Across the Role
- Build defensive automation: Design, build, and improve AI-driven security tooling, with the testing, safeguards, and human oversight you’d expect of production systems.
- Threat-model: Assess new and existing systems for risk, and use those models to decide where detection and remediation effort goes.
- Respond to incidents: Join the response rotation for critical vulnerabilities and security events, from assessing exposure through remediation.
- Track how well our security work is performing, and explain risks and tradeoffs clearly to technical and non-technical audiences.
