JOB SUMMARY We are looking for two motivated, fresh-graduate engineers to join our AI Innovation Lab, working closely with our Cybersecurity Lab. You will initially support the build-out of a governance and audit-evidence control plane for AI agents operating across APAC — a rare opportunity to work at the intersection of AI engineering, security, and regulatory compliance. You will help translate real data-privacy law (Philippines, Australia, Singapore) into working policy logic that governs what autonomous AI agents are allowed to do with data, and produce the audit trail a regulator would expect to see. You will work closely with the AI Innovation Lab Lead and the Cybersecurity Lab to research the problem space and build a working prototype from the ground up. As this is a Lab-wide role, you may be assigned to other AI Innovation Lab initiatives as projects evolve. JOB RESPONSIBILITIES - Read sections of real data-privacy laws (e.g. Philippines Data Privacy Act, Australian Privacy Act, Singapore PDPA) and help turn them into clear "if this, then that" rules our system can follow. Example: "If a Philippine customer's health data is about to be sent to a server outside the Philippines, block it unless we have documented consent on file." - Look into what existing privacy-compliance and AI-agent security tools currently do, and write up clearly what they do and don't cover. Example: a one-page note answering "does this specific tool stop an AI agent from sending sensitive data overseas in real time, or does it just log the fact afterward?" - Help build parts of the policy engine — the part of the system that decides whether an AI agent's action should be allowed, blocked, redacted, or rerouted based on the jurisdiction of the data involved. Example: writing the code that checks an incoming data request against a rule and returns a decision like BLOCK or ALLOW. - Support development of the residency-routing logic that keeps data subject to a localisation rule processed and logged within the correct jurisdictional perimeter. Example: making sure a request involving an Australian customer's data is routed to, and logged in, an Australia-based path rather than a shared/default one. - Build the logging system that records every decision the policy engine makes, in a format a compliance officer could read and understand later. Example: a log entry showing what agent made the request, what data was involved, what was decided, and which rule was cited. - Connect the policy engine to other systems (e.g. MCP servers, AI agent platforms) so it can see and act on real requests, not just test data. Example: writing the small connector code that lets an AI tool send a request to our policy engine and receive a decision back. - Help build a simple dashboard where a compliance team member can view agent activity and download reports. Example: a table showing Date | Agent | Action | Decision | Rule Cited, with a button to export it. - Write clean, tested code and participate in code review, working alongside senior engineers who will guide overall system design. - Write clear notes about what you researched, built, or decided, so a teammate (or future you) can understand it without redoing the work. Example: a short weekly note — what you researched or built, what you concluded, and what's still unclear. - Meet regularly with senior engineers and the AI Lab Lead to share progress and raise anything that's blocking you. Example: a 15-minute daily check-in covering what you finished, what's next, and where you're stuck. - Support the team through the prototype phase, with an eye toward hardening the system for real design-partner deployments as the project matures. QUALIFICATIONS - Bachelor's degree in Computer Science, Information Technology, Data Science, Engineering, or a related field - Comfortable digesting dense, formal text (e.g. a contract clause, terms of service, an academic paper, or a law) and restating the key point as a simple rule in your own words — no legal background or prior regulatory experience needed, just patience with complicated writing and clear logical thinking. If you've ever had to figure out what a scholarship contract or a school policy actually required you to do, that's the same skill. Example: during the interview, we'll give you one real paragraph from a privacy law and ask you to write it out as an "if this, then that" statement — no legal background required, just careful reading. - Solid grasp of Python (preferred) or another backend language (TypeScript/Node.js, Go, or similar), and willingness to work in whatever the team's stack requires; basic backend/API concepts (e.g. FastAPI, REST) - Comfort reasoning about how a request flows through a service and where logic should live, along with a basic understanding of access-control ideas — the concept of "this user/agent is allowed to do X but not Y," similar to file permissions on a computer - Able to explain, in plain language, what you found after reading something technical or legal — a short written summary someone non-technical could follow - Strong attention to detail — this product's value depends on evidence being accurate and auditable, so precision matters more than in typical consumer software - Comfortable starting a task without a complete instruction sheet, and able to make a reasonable judgment call or ask a clarifying question to move forward, rather than needing every step spelled out. Example: in the first few weeks you might be asked to "find out if Vendor X already solves problem Y" without being told exactly how — you'd figure out a reasonable way to check (read their docs, try their product, search for case studies) and flag your findings, adjusting as you learn more rather than waiting for a fixed checklist. - Genuine interest in AI security, governance, or privacy/compliance topics — this can come from coursework, personal projects, or just curiosity, not necessarily work experience - Exposure to cybersecurity fundamentals (e.g. coursework in network/application security, secure coding practices, or a personal CTF/security project) is valued, given the project's overlap with AI-agent security boundaries. Candidates with actual hands-on cybersecurity experience or practice — e.g. a security-focused internship, freelance/bug-bounty work, placing in CTF competitions, or mentorship under a real cybersecurity practitioner/team — are a strong plus. - Willingness to learn and ability to work in a small, close-knit team environment - Preferably Batangas-based; this is a hybrid role that requires in-person attendance at our Lipa office at least 3 days a week to collaborate with the team NICE TO HAVE: - Exposure to policy-as-code, rules engines, or authorization frameworks (e.g. OPA/Rego, Casbin) - Familiarity with audit logging, immutable data stores, or event-sourcing patterns - Basic frontend exposure (e.g. React/Next.js) - Interest in APAC markets or regulatory environments - Experience with LLM/agent tooling or building against LLM APIs