Job Description

There’s a particular satisfaction in finding the clue that helps everyone breathe again.

You follow it. You make sense of what happened. You help people get back to the work they care about.

As Mercola’s Senior AI Security Engineer, you’ll turn that instinct into something people can count on. Feel the pride of seeing a fix hold because you stayed with the problem long enough to prove it worked. Help build a team where people feel comfortable saying, “Something feels off,” and know they’ll be heard.

Imagine a colleague pausing just before giving a new tool access to something sensitive. They ask one more question because you showed them what to look for. There’s a quiet pride in that moment, too. The judgment you shared stays with them, ready for the next call they have to make.

ROLE SNAPSHOT

• Pay $130,000–$150,000 annual base, based on relevant experience and demonstrated capability.
• Location/Schedule US-based, remote or hybrid, full-time.
• Purpose Own day-to-day enterprise security, lead technical incident response, and help Mercola use and secure AI across the business.

KEY RESPONSIBILITIES

• Own the incident queue, risk register, and remediation backlog. Assign owners and deadlines, maintain policies and runbooks, and report progress and unresolved risks to leadership.
• Lead technical incident response from triage through recovery validation. Coordinate containment, preserve evidence, and involve Legal or specialist responders as needed.
• Strengthen identity, access, and infrastructure controls across Microsoft 365, Entra ID, AWS, and connected applications. Partner with Infrastructure to verify improvements across endpoints, servers, networks, and cloud platforms.
• Validate logging coverage, retention, alert delivery, and after-hours escalation with internal owners and managed security providers.
• Use AI assistants for investigation, code review, threat analysis, and automation. Independently validate findings and proposed fixes before acting on them. Secure AI applications, agents, and Model Context Protocol (MCP) integrations against prompt injection, excessive permissions, data exposure, and unsafe tool actions.
• Partner with Engineering on application, API, and mobile security. Integrate code, dependency, and secret scanning into development workflows, prioritize exploitable findings, coordinate authorized testing, and verify remediation.
• Build security automation with Python, PowerShell, APIs, or comparable tools. Document ownership, failure alerts, audit trails, and rollback procedures.
• Assess vendor security, data flows, and third-party access. Maintain security evidence for applicable contractual, privacy, and compliance needs, and coordinate security awareness and specialist support.

MUST-HAVE QUALIFICATIONS

• Hands-on experience in security engineering, incident response, or security operations, with examples of taking issues through investigation, remediation, and verification.
• Practical experience securing hybrid environments across Microsoft 365 and Entra ID, cloud services such as AWS, endpoints, and networks. Ability to interpret logs and assess access, application permissions, and potential data exposure.
• Experience using AI assistants in engineering or security work. Ability to explain how you limit permissions, protect sensitive information, and validate AI-generated output.
• Ability to write scripts, work with APIs, and review application code or configurations for security issues. Familiarity with Git and CI/CD workflows.
• Ability to prioritize competing security work, coordinate technical owners and providers, and communicate risks and decisions clearly to leadership.
• Sound judgment about evidence preservation, testing authorization, production changes, and when to involve specialists.

PREFERRED QUALIFICATIONS

• Experience with Microsoft Defender or comparable endpoint protection, security information and event management (SIEM), or managed detection services.
• Experience with Azure DevOps, application or API security testing, cloud or container security, or governance of AI coding tools and MCP integrations.
• Relevant certifications or a degree are welcome. Mercola values demonstrated capability and equivalent experience equally.

WHAT WE OFFER

• The opportunity to shape Mercola’s dedicated Security function and establish how it operates day to day.
• Direct access to leadership to align priorities, escalate risks, and secure decisions.
• A hands-on role spanning enterprise incident response, security automation, and AI security, with Infrastructure and Engineering partners who own implementation in their respective areas.

Honest Challenge

You’ll be the primary internal security practitioner, balancing active incidents with longer-term improvements across a broad estate. You’ll help define backup coverage, provider responsibilities, and after-hours escalation. Infrastructure owns platform operations, maintenance, backups, and business continuity. Engineering owns application changes. You’ll set security requirements, coordinate response, and verify closure. Authorized leadership owns budget and material business-risk decisions.

In your first 90 days, you’ll establish clear ownership, an actionable risk backlog, dependable monitoring, and tested escalation. You’ll validate priority identity, credential, endpoint, and logging controls, drive findings to verified closure, and deliver repeatable automation and a safe AI-assisted workflow with usable runbooks and backup ownership.

PLEASE NOTE: While we appreciate candidates who reach out directly, given the volume, we are unable to respond to each inquiry individually.

The pay range for this position is $130,000–$150,000 annually. Please note that the quoted pay range for this job is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) experience, including industry or specific experience, education, knowledge, skills, and abilities, as well as internal equity, alignment with market data, and/or other applicable laws.

This position is benefits-eligible. Mercola provides competitive, affordable, and diverse benefit programs that support your total health – from a healthy body to a healthy mind. These benefits support you and your family in all aspects of life:

· Medical, Dental, and Vision coverage

· Optional Accident, Hospital Indemnity, and Critical Illness

· Employee Assistance Program (EAP)

· Employer-paid Life and AD&D Insurance

· Optional Supplemental Life and AD&D Insurance

· Short- and Long-Term Disability Insurance

· Flexible Spending Accounts

· Health Savings Accounts

· Dayforce Wallet – get paid as you earn

· Employee Discount

· Retirement Planning (401k with matching contribution)

· Pet Insurance

· Wellness Program Offerings

· Paid Time Off, accrued per pay period based on years of service, starting at 15 days annually.

· 9 Paid Holidays per year, including 1 floating holiday.

The compensation and benefits information is accurate as of the date of this posting. The Company reserves the right to modify this information at any time, with or without notice, subject to applicable law.

The Company expects to accept applications for this position until November 16, 2026, but encourages interested applicants to apply as soon as possible. We will review this information, and one of our Talent Acquisition professionals will reach out if your background aligns with the position.

Our Commitment to Equal Opportunity and Inclusion

Mercola and its affiliates (“Mercola”) are proud to be an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race (including hairstyle and texture), color, religion or belief (or lack thereof) (including religious grooming and dress practices), sex, nationality, national or ethnic origin, civil status, age, citizenship status, sexual orientation, disability, genetic information, familial status, marital or registered civil partnership status, pregnancy or parental status, gender identity, gender reassignment, military or veteran status, or any other protected characteristic in accordance with applicable laws and regulations. If you need accommodation, please send an email to hr@mercola.com to let us know the nature of your request.

Avoid Recruitment Scams

Mercola has become aware of fraudulent recruiting activities being conducted by individuals falsely claiming to represent our company using email addresses associated with the @mercolacareers.com domain.

Please be advised that Mercola will never ask job applicants to pay fees, purchase equipment, provide banking information, or send money at any stage of the recruiting or hiring process.

All legitimate employment opportunities are posted exclusively on our official Careers page, and all recruitment-related email communications from Mercola will come only from authorized company email addresses ending in @mercola.com.

If you receive a suspicious email, text message, or other communication claiming to be from Mercola, particularly one using the @mercolacareers.com domain, we encourage you not to respond, click any links, or provide any personal or financial information. If you believe you have been targeted by a recruiting scam, please report the incident to your local law enforcement authorities and, if appropriate, to the platform where the communication originated.