Open to Forward Deployed and Solutions Engineer roles in AI security

Shreyashri Vishwanath Athani IT auditor who opens the hood on AI systems

I spent four years testing access, change and logging controls at EY and Goldman Sachs. Now I build the AI systems those controls are meant for.

At Tiptop Technologies I'm the client-facing engineer for NuGuard AI, turning compliance requirements into automated control checks. Separately, I built Reception 360, a voice agent that answers patient calls for dental clinics, with deterministic guardrails around the LLM. So when a security team asks whether an agent is safe to ship, I can talk to the engineers and the auditors in their own language.

LinkedIn ↗ GitHub ↗ Substack ↗

WP A

What are you hiring for?

Pick the role. You'll get a control matrix: what that job asks for, and where in this portfolio the evidence lives. Auditors call this tracing a requirement to source.

The role needs	Evidence	Ref

Sending this to someone? Add #fde, #se, #csm or #gov to the link and the matrix opens on that role.

WP B

Experience

Audit first, then building. The through-line is the same set of controls: who can access it, how it changes, and whether the logs can prove it.

May 2026 – nowRemote

Applied AI Engineer, NuGuard AI

Tiptop Technologies

Client-facing engineer for NuGuard AI, an AI security product. I translate compliance requirements into 6+ automated control checks with evidence collection, and document them for customers and our internal team.
Write NuGuard's educational LinkedIn content on AI risk, security and compliance, aimed at both compliance and engineering readers.
Run a 3-month Reddit community program across SaaS, healthcare, e-commerce and fintech, coordinating five contributors. Engagement and product sign-ups are up 30%.

Also at Tiptop: leading Rocket360

Rocket360

I lead Tiptop's partner growth program: pitching, discovery calls on each partner's pain points, staffing the team and setting timelines. 17 sign-ups and 5 collaborations so far, with partners in the US, India and the Middle East.

AI security GTMControl automationVoice agentsTechnical writing

Jul 2025 – Feb 2026New York City

IT Consultant, Internal Audit

Goldman Sachs · contract via Genesis10

Audited the firm's generative AI assistant, testing access, change management and logging controls.
Audited SDLC (CI/CD pipelines), patch management and cyber resiliency, working directly with engineering teams to gather evidence and close control issues.
Reported findings to engineering, senior leadership and the second line of defense with Python and Tableau dashboards built for non-technical readers.
Mentored two new joiners on audit methodology, control testing and workpaper standards.

GenAI auditSDLC / CI/CDVulnerability mgmt

Jan – Apr 2025Boston

Teaching Assistant

Northeastern University

Ran Python and Tableau help sessions and gave written feedback on student analytics projects.

Feb 2021 – Jul 2023Bengaluru

Technology Risk Associate, Assurance

Ernst & Young LLP

Tested IT general controls for SOX clients across identity and access management, change management (CI/CD) and cloud infrastructure. These are the same control areas behind SOC 2.
Assessed authentication, authorization and credential management across APIs, DevOps pipelines and cloud environments.
Scoped evidence requests with client IT teams, walked through controls, and explained deficiencies with clear remediation steps.
Automated audit testing with Python and Excel, cutting testing time by 20%. Built KRI dashboards for senior leadership.

ITGC / SOXIAMCloud & DevOpsAudit automation

WP C

Projects

Things I built, and how I thought about the risk in each.

C-1 · Voice agent · 2026Twilio · Pipecat · Deepgram · Claude · ElevenLabs · Google Calendar API

Reception 360

A voice agent that picks up a dental clinic's phone, answers patient questions and books appointments. Clinic staff get a web console with call logs, transcripts, appointments, patients, doctors and insurance views, behind role-based login for admin, front desk, doctor and patient.

Patient calls mean PHI, so I treated the LLM as the one part of the system I couldn't fully trust and built deterministic checks around it. Here's how the design maps to the controls an auditor would test:

AccessRole-based login. Front desk, doctors and patients see different data.

LoggingEvery call is kept with its transcript, so there's a trail to review.

Agent actionsBooking runs through a fixed calendar integration, not free-form model output.

Data handlingDesigned for a PHI environment from day one.

Live product · demo on request

C-2 · Team project · 2025LlamaIndex · FAISS

Pawsistant

A RAG assistant for Northeastern's Office of Global Services, the office international students rely on for visa and policy questions. An ETL pipeline indexes 60+ policy pages. It runs as a CLI and a web app, switches between Claude and GPT, and has CI on GitHub Actions.

GitHub ↗

C-3 · Analytics · 2024Tableau

Zillow rental analytics

An ETL pipeline and EDA on rental pricing, with two interactive Tableau dashboards using custom metrics and a composite score.

GitHub ↗Tableau ↗

WP D

Review this agent log with me

This is how I think about agent risk. Below is a made-up log from a support agent at a fictional fintech. Tick every line you'd raise as a finding, then check your answers against mine.

agent: atlas-support · env: prod2026-10-14 · sample, fictional

0 lines ticked

WP E

Along the way

A few things I'm glad I did, what I write about, and the frameworks I work from.

30%

Growth in engagement and sign-ups from the NuGuard Reddit program I run.

17 / 5

Rocket360 sign-ups and collaborations since I started leading the program.

20%

Less audit testing time at EY after I automated it with Python and Excel.

Automated control checks shipped for NuGuard customers.

"I Am Exceptional" award for leadership at Ernst & Young.

1:1

Volunteer mentor at Code the Dream, teaching applied and responsible AI (Feb – May 2026).

Writing

Auditing agentic AI

On Substack I work through how you'd actually audit an AI agent: what evidence exists, which ITGC controls carry over, and which ones don't. There's a case study in there too.

At NuGuard I also write LinkedIn posts that explain AI risk, security and compliance to engineers and compliance teams.

Read on Substack ↗

Frameworks

NIST AI RMFOWASP LLM Top 10SOC 2SOX / ITGCHIPAAAccess reviewsChange management

Building

PythonSQLREST APIs / JSONRAG (LlamaIndex, FAISS)Voice agentsDockerCI/CD · GitSSO / IAM

With customers

Discovery & scopingTechnical writingWorkshopsExec reportingTroubleshooting

Education

MS Data Science, Northeastern University (2025)
B.Tech Computer Engineering, PES University (2021)

WP F

Off the clock

The non-billable hours. Mostly spent on a trail.

Shreyashri holding the chains on the Angels Landing trail — **Angels Landing**On the chains

Shreyashri smiling at the top of Angels Landing, Zion National Park — **Made it**Top of Angels Landing

Shreyashri sitting on a rock ledge above fall foliage in the Catskills — **Kaaterskill**Fall hike, Catskills

Trail log · summits verified4 of ∞

Angels LandingZion, Utah
KaaterskillCatskills, New York
Acadia National ParkMaine
New Hampshire trailsNew Hampshire

I'll hold the chains on a cliff edge, but I still want the evidence before I trust a control. I read birth charts, Western and Vedic. Always halfway through a romance novel.

WP G

Let's talk

If you're shipping AI agents into companies that have to answer to auditors, I'd like to hear about it.

athanishreyashri@gmail.com

LinkedIn ↗ GitHub ↗ Substack ↗ Tableau ↗