Entry Level Forensic Behavior Analyst Jobs in Dallas, TX

Who We Are

At Upbound Group, we are committed to elevating financialopportunityfor all through innovative, inclusive, and technology-driven financial solutions that address the evolving needs and aspirations of consumers. The Company's customer-facing operating units include industry-leading brands such as Rent-A-Center, Acima and Brigit that facilitate consumer transactions across a wide range of store-based and digital retail channels, including over 2,400 company-branded retail units across the United States, Mexico, New York and Puerto Rico.Upbound Group, Inc. is headquartered in Plano, Texas.

Role Summary

We are seeking a forward-thinking AI Cybersecurity Engineer to join our Security team.This role sits at the convergence of Generative AI, agentic systems, Zero Trust architecture, and modern data protection engineering. The AI Cybersecurity Engineer will design, build, and operationalize next-generation AI-driven security capabilities such as security agents, Retrieval-Augmented Generation (RAG) pipelines, and Model Context Protocol (MCP) integrated toolchains, while also strengthening the foundational Zero Trust, Data Loss Prevention (DLP), Data Security Posture Management (DSPM), and network security controls that protect our infrastructure, data, and users.

This is a hybrid specialist role. Approximately 60% of the work is focused onforwardingAI-native engineering initiatives and representation within Technology; the remaining 40% is focused on Zero Trust, data protection, and network security engineering initiatives.

Key Responsibilities

AISecurity and AI-Native Cybersecurity Engineering

GenAI and LLM Application Security

• Secure GenAI deployments including LLM APIs, fine-tuned models, and foundation model integrations against threats such as prompt injection, jailbreaking, training data poisoning, and model inversion attacks.

• Build andmaintainguardrails, content moderation layers, and output validation pipelines for GenAI systems and LLMs used in security and business workflows.

• Conduct adversarialred-teamingof GenAI systems, agent platforms, and LLMs toidentifyexploitable behaviors, unsafe outputs, and data exfiltration risks; develop remediation playbooks.

Agentic Systems and Model Context Protocol (MCP) Security

• Apply Zero Trust principles to AI agents, ensuring agents operate under strict least-privilege policies with scoped, time-limited credentials; secure multi-agent systems (MAS) that autonomously perform security tasks such as threat hunting, incident triage, vulnerability scanning, and policy enforcement.

• Define agent trust boundaries, inter-agent communication security, and human-in-the-loop (HITL) checkpoints to prevent runaway oradversariallyhijacked agent behavior.

• Implement agent observability frameworks that log, trace, and audit all agent decisions, tool calls, and external API interactions for forensic and compliance purposes; assess agentic-specific attack surfaces including goal hijacking, tool misuse, privilege escalation via chained tool calls, and unintended data exfiltration.

• Evaluate, harden, and govern the use of Model Context Protocol (MCP) servers that expose enterprise tools and data to AI agents, treating each MCP server as a security boundary requiring authentication, authorization, and audit logging.

• Define and enforce MCP server access control policies ensuring agents can only invoke permitted tools within approved scopes; assess MCP-specific risks including prompt-injected tool invocation, unauthorized resource access through MCP resource endpoints, and lateral movement via chained MCP server calls.

• Collaborate with platform and integration teams toestablishsecure MCP deployment standards, includingmTLSfor server communication,secretsmanagement for server credentials, and rate limiting for tool invocations.

RAG Pipeline Security

• Harden RAG pipelines against retrieval manipulation attacks, indirect prompt injection via poisoned knowledge base documents, and sensitive data leakage through retrieved context.

• Design RAG pipeline monitoring and anomaly detection toidentifyunusual retrieval patterns, high-entropy queries indicative of extraction attacks, and drift in retrieved context quality.

AI-Enabled Security Operations

• Build and deploy ML models for real-time threat detection, behavioral anomaly detection, and user/entity behavior analytics (UEBA) across network, endpoint, and cloud telemetry.

• Develop LLM-powered SOAR integrations that automate alert triage, root cause analysis, runbook execution, and stakeholder communication using natural language generation; create GenAI-assisted threat hunting workflows that allow analysts to query security data in natural language, with results grounded in live telemetry via RAG.

AI Governance and Assurance

• Help embed AI security controls (input validation, output filtering, adversarial testing) into CI/CD pipelines for AI systems alongside traditionalDevSecOpspractices andcontribute to AI Bill of Materials (AI-BOM) tracking: a comprehensive inventory of all deployed models, dependencies, training data sources, agents, MCP servers, and RAG pipelines that supports supply chain security and compliance audits.

• Produce threat models, security architecture reviews, and risk assessments for AI-enabled products;maintainliving documentation as systemsevolve andintegrate AI-driven tools into daily engineering work to enhance decision-making quality and accelerate innovation across deliverables.

Zero Trust, Data Protection and Network Security

Zero Trust Architecture

• Assistin designing, implementing, and maturing Zero Trust architecture aligned to NIST SP 800-207 across cloud-native and hybrid environments, including identity-based segmentation, continuous verification, policy enforcement points, and least-privilege access for both human and non-human identities.

• Assistin governing privileged access management (PAM) and secrets management across service accounts, workload identities, and AI agents, including credential rotation, just-in-time elevation, session auditing, and elimination of standing privilege.

• Establish conditional access and device posture requirements for access to sensitive systems and AI tooling, incorporating identity, device health, and network context into access decisions.

Data Loss Prevention

• Assistin designing, deploying, and tuning enterprise DLP controls across endpoint, network, email, and cloud channels to prevent exfiltration of sensitive consumer data including PII, SSNs, and payment card information.

• Assistin authoring DLP policies, data classification standards, and sensitivity labeling schemes; build detection logic including custom and exact data matching (EDM) classifiers and manage false-positive tuning in partnership with business stakeholders.

Data Security Posture Management

• Assistin implementing and operating DSPM capabilities to discover, classify, and continuouslymonitorsensitive data across cloud storage, databases, SaaS platforms, and unstructured repositories,establishingauthoritative visibility into where regulated consumer dataresides.

• Remediate data exposure risk surfaced through DSPM, including over-permissioned data stores, shadow data, stale sensitive data, and excessive access paths;validatedata store security posture before it is exposed to AI agents, RAG pipelines, or MCP servers.

• Partner with Data, Privacy, and Compliance teams to enforce data residency, retention, and minimization requirements, applying tokenization, redaction, and encryption whereappropriate.

Network and Cloud Security

• Engineer andmaintainnetwork security controls including segmentation andmicrosegmentation, secure web gateway and Cloud Access Security Broker (CASB) enforcement, Zero Trust Network Access (ZTNA), IDS/IPS, and egress filtering for both traditional workloads and AI service traffic.

• Strengthen cloud security posture across AWS, Azure, and GCP using Cloud Security Posture Management (CSPM), cloud-native IAM, and misconfiguration detection; secure network paths to cloud AI services and enforce controls on traffic to external LLM providers.

Required Qualifications

Experience and AI Security

• 5+ years of experience in cybersecurity engineering, with at least 2 years of hands-on experience in AI/ML security, GenAI systems, agentic platforms, and LLMsecurity.

• Demonstrated experience securing LLM-based applications, including prompt injection defenses, output validation, and responsible AI guardrails.

• Hands-on experience building or securing RAG pipelinesand MCPservers.

• Familiarity with agentic AI frameworks (LangChain,LangGraph,AutoGen,CrewAI, or equivalent) and the security risks associated with autonomous multi-agent systems.

Zero Trust, Data Protection and Network Security

• Deep understanding of Zero Trust architecture principles (NIST SP 800-207) and hands-on experience implementing controls in cloud-native or hybrid environments.

• Hands-on experience deploying and operating enterprise DLP across endpoint, network, email, and cloud channels, including policy authoring, data classification, custom orexact-data-match classifiers, and false-positive tuning.

• Experience with data discovery, classification, or DSPM tooling (for example Microsoft Purview, Varonis,BigID, Cyera, orSpirion) to inventory andmonitorsensitive data across cloud and on-premises repositories.

• Experience implementing DLP controls within AI pipelines, including mechanisms to detect and block sensitive consumer data (such as PII, SSNs, and payment card information) from being transmitted to external LLMs or stored in AI system logs; familiarity with data residency requirements and privacy-preserving techniques (e.g., tokenization, redaction) as applied to GenAI workflows.

• Network security engineering experienceincludingsegmentation, secure webgatewayor CASB, ZTNA, IDS/IPS, and egress control.

• Hands-on experience with cloud security in at least one major cloud platform (AWS, Azure, or GCP), including cloud-native IAM, Cloud Security Posture Management (CSPM), and cloud AI service security controls.

• Working knowledge of identity and access management (IAM), OAuth 2.0 / OIDC, privileged access management (PAM), and secrets management (HashiCorpVault, AWS Secrets Manager, Secret Server,CyberArkorDelinea) in the context of both enterprise and AI system authentication.

Operations, Governance and Communication

• Experience with SIEM/SOAR platforms (Rapid7, Microsoft Sentinel) and integrating AI capabilities into security operations workflows.

• Familiarity with MITRE ATT&CK, MITRE ATLAS (adversarial threats to AI/ML systems), and OWASP LLM Top 10.

• Experience developing and executing incident response procedures specific to AI systems, including response plans for model compromise, agent misbehavior events, and data exfiltration through LLM outputs.

• Demonstrated ability to author enforceable security policies and standards, including acceptable use frameworks, data classification guidelines, and AI security control baselines applicable across engineering and business teams.

• Excellent communication skills; able to translate complex AI security and data protection risks for executive, legal, and non-technical audiences.

Preferred Qualifications

• Hands-on experience with Model Context Protocol (MCP) security controls in enterprise environments.

• Direct experience deploying or securing Claude Enterprise or a comparable enterprise AI assistant platform, including API security hardening, usage policy governance, role-based access controls, and audit logging configuration.

• Experience conducting structured AI red-teaming exercises against LLMs, RAG systems, or autonomous agents, including goal hijacking and tool misuse scenarios.

• Knowledge of adversarial ML (evasion, poisoning, model extraction) and model interpretability techniques (SHAP, LIME, attention visualization).

• Experience with AI governance, AI auditing, and compliance frameworks including NIST AI RMF, ISO 42001, or SOC 2 Type II for AI systems.

• Experience with enterprise CASB, secure web gateway, or enterprise browser platforms (Netskope, Zscaler, Palo Alto Networks, or equivalent).

• Experience in regulated consumer finance, payments, or retail environments, with working knowledge of PCI DSS, GLBA, or SOX control expectations.

• Relevant certifications: CISSP, CISM, CEH, AWS/Azure/GCP Security Specialty, or emerging AI security credentials.

Work Location

Ability to work in the Plano, Texas or Draper, Utah office, Monday through Friday, with travel between locations as necessary based on transformation and governance activities.

Employment Eligibility

To be eligible for t...