EmergingPrivacy-preserving and confidential AI

Confidential AI Engineer

Also called Confidential Computing Engineer, AI

A Confidential AI Engineer runs model training and inference inside attested, restricted execution environments. They let a company use sensitive data and protect model weights without trusting every layer of the infrastructure underneath.

What they do

They take a model workload and make it run inside a trusted execution environment. That means choosing the confidential compute setup, building the attestation flow, and deciding how keys are issued, held and rotated. They check that only approved code ever sees decrypted data or weights. They test the result with privacy attack suites and write up what exposure is left. They also work with ML engineers on the performance cost of running inside enclaves, and with security and legal teams on what the guarantees actually cover. Much of this work sits today inside security or privacy engineering titles.

What a strong hire delivers

A working confidential inference or training path that runs in production-like conditions. A clear attestation chain that a third party could check. A key management design the security team accepts. A residual exposure analysis that states plainly what is still at risk. Documentation that lets other engineers deploy new models into the same setting without starting again.

How you can tell they are good

Ask them to walk through an attestation flow they built, from hardware measurement to key release. Strong people explain what is trusted and what is not, and where the design still leaks. They talk about side channels and operational failure, not just the happy path. Be wary of anyone who says the enclave makes the data safe and stops there.

Why it is hard to fill

Almost nobody has this title yet. The skills are split between security, cryptography and ML infrastructure, and few people hold all three. Those who do are usually inside larger teams doing it as part of something else, so they rarely look like a match on paper. Candidates often have deep depth in one area and thin knowledge of the others. We spend time judging which gap is easiest to close.

Where to find them

Look at security engineers who have worked with trusted execution and key management, privacy engineers who have moved towards infrastructure, and applied cryptographers who have shipped systems. Some come from ML platform teams that handled regulated data. Typical employers are cloud and confidential compute providers, security-led start-ups, and AI companies selling into health, finance or government.

Indicative pay

Not enough published evidence yet to give a fair range for this role, which is common for work this new. We benchmark it for you as part of a search.

Interview questions for a Confidential AI Engineer

  1. Describe a system where you used attestation to gate access to keys. What did it prove, and what did it not?

    A strong answer names the measurements checked, who verifies them and how keys are released. They state the limits openly, such as side channels or trusting the hardware vendor. Worry if they treat attestation as a complete guarantee.

  2. How have you handled key rotation and revocation for a workload that runs for a long time?

    Look for practical detail on key hierarchy, rotation without downtime, and what happens when an environment fails attestation. Worry about answers that leave keys in configuration or ignore recovery.

4 more questions, with what a strong answer covers, are in the Role Kit.

Job description you can post

We are hiring a Confidential AI Engineer to help us run training and inference on sensitive data and valuable model weights inside attested, restricted environments. You will work with ML, security and product teams to turn strong guarantees into systems that ship and that customers can verify.

What you will do

  • Integrate model training and inference workloads into trusted execution environments
  • Design and build attestation flows that others can verify
  • Own key management, including issuing, rotation and revocation
  • Test deployments with privacy attack suites and fix what they find
  • Write residual exposure analyses that state remaining risk plainly
  • Work with ML engineers to manage performance costs
  • Document patterns so other teams can deploy safely

What you will bring

  • Shipped a system using trusted execution or confidential compute
  • Hands-on work with key management and cryptographic libraries
  • Clear understanding of attestation and its limits
  • Background in privacy engineering, security, cryptography or ML
  • Able to explain technical risk to non-specialists
  • Evidence of testing your own designs for weaknesses

Nice to have

  • Experience with formal verification
  • Experience with data provenance controls
  • Familiarity with ML accelerators in restricted environments

Free to use and adapt. If it saves you time, a link back to this page is appreciated.

Skills that matter

  • Privacy engineeringAdvancedLimit disclosure and unauthorised personal-data use
  • Security engineeringAdvancedProtect systems, identities and sensitive assets
  • Formal verificationWorkingProve stated properties under explicit assumptions
  • Data quality and provenanceWorkingTrack dataset origin, validity and transformations

Other roles in privacy-preserving and confidential AI

Hiring nowPrivacy-Preserving ML ResearcherA Privacy-Preserving ML Researcher builds learning methods that limit what a model can reveal about the data behind it. That lets a company train…EmergingAI Privacy Attack ResearcherAn AI Privacy Attack Researcher tests, with authorisation, whether a model or its data can leak sensitive information. They show the company where…Hiring nowAI Privacy EngineerAn AI Privacy Engineer builds consent, minimisation and access controls into AI workflows, so sensitive data is not exposed in training or…

Related roles in other families

EmergingAI Control ResearcherAI control, monitoring and containmentAn AI Control Researcher designs the safeguards that limit what a model can do if it turns out to be unreliable or hostile. They keep risk bounded…EmergingAgent Containment EngineerAI control, monitoring and containmentAn Agent Containment Engineer builds the boundaries that keep AI agents from doing harm, even if the model misbehaves or is attacked. They matter…EmergingAI Monitor Evaluation EngineerAI control, monitoring and containmentAn AI Monitor Evaluation Engineer tests whether the systems that watch model behaviour actually catch dangerous or unauthorised actions. It matters…EmergingAI Shutdown and Recovery EngineerAI control, monitoring and containmentAn AI Shutdown and Recovery Engineer builds and tests the ways to stop an AI system mid-action and bring it back to a known good state. It matters…

How we wrote this

Role definitions are our own editorial work, checked against occupational classifications, standards, research and employer pages. Titles vary by company, and this is a description of the work, not a job advert.

← Privacy-preserving and confidential AIAll new job families

Start a search

Hiring a Confidential AI Engineer?

Tell us the work. We find the people already doing it, whatever their job title says, and you meet them already interviewed for your role.