AI Security SME

You will lead the security architecture, governance, and assurance of our AI and GenAI platforms across the organization. This includes classical ML systems and modern LLM/agentic architectures. You will define how models are designed, deployed, monitored, and defended; ensure they are robust, explainable, privacy-preserving, and compliant; and act as the go-to expert for AI security across products, data, cloud, and security teams.

• AI Security Architecture
  • Design and review secure architectures for ML/LLM workloads (training, fine tuning, inference, RAG, agents, plugins, tool calling, APIs).
  • Define reference architectures for on-prem, hybrid, and cloud AI platforms (Azure OpenAI, AWS Bedrock, GCP Vertex, self-hosted models, etc.).
• Threat Modeling & Risk Management
  • Perform AI-specific threat modeling (e.g., data poisoning, model theft, prompt injection, jailbreaks, supply-chain, inference attacks) using MAESTRO or similar framework.
  • Align controls with leading frameworks: NIST AI RMF, ISO/IEC 27001, ISO/IEC 27090, ISO/IEC 42001, OWASP GenAI / LLM Top 10, CSA & MITRE ATLAS.
• Security Control Design & Implementation
  • Define and oversee implementation of controls for:
    • Training & data pipelines (data quality, provenance, labeling, PII protection).
    • Model & artifact integrity (signing, SBOM, secure registries).
    • Access control, isolation, rate limiting, and abuse detection.
    • Secure prompt engineering and guardrail policies.
    • Security prompt monitoring to detect ongoing attacks.
    • Data security: data classification, data masking and DLP.
    • MCP server hardening.
• Reliability & Trustworthiness
  • Partner with engineering and data science to embed robustness, observability, fallback strategies, and evaluation pipelines (safety, bias, toxicity, hallucination monitoring).
  • Contribute to SLOs/SLAs for AI systems, including security and reliability KPIs.
• Secure SDLC for AI
  • Embed AI security into CI/CD: scanning, dependency checks, policy-as code, red-teaming AI components pre- and post-release.
• Incident Response & Red Teaming
  • LLM bias detection.
  • Perform red teaming activities to abuse and force AI hallucinations.
  • Develop and maintain AI-specific playbooks (prompt abuse, model exfiltration, data leakage, compromised agents).
  • Lead or support AI red/blue/purple teaming exercises using frameworks like MITRE ATLAS.
• Governance, Compliance & Policy
  • Advice on alignment with emerging AI regulations and standards (e.g., EU AI Act, regional laws, internal AI use policies).
  • Define internal policies on responsible AI, data usage, model lifecycle, and 3rd-party AI risk management.
• Stakeholder Leadership
  • Run workshops, training, and awareness for engineering, security, and business teams.

• 8-12+ years in Cybersecurity, with 3-5+ years focused on AI/ML or data platforms (can be overlapping).
• Hands-on experience with:
  • Cloud platforms (Azure, AWS, GCP) and their AI services.
  • At least one Agentic/GenAI stack (e.g., Transformers, Lang Chain/Llama Index, vector DBs, model gateways, MLOps platforms).
• Proven track record designing or reviewing secure architectures for:
  • ML pipelines, LLM/RAG systems, or agentic/automation platforms.
• Strong understanding of:
  • Cryptography, identity & access management, network & app security.
  • Data protection & privacy (PII, PHI, DPIA concepts).
• Experience working with or mapping to frameworks/standards such as:
  • NIST AI RMF, ISO/IEC 27001, ISO/IEC 42001, SOC 2, OWASP Top 10 & OWASP GenAI/LLM Top 10, MITRE ATT&CK/ATLAS, CSA guidance.
• Excellent communication skills: able to translate complex AI risks into clear business and technical requirements.

• AI/ML & GenAI fundamentals:
  • Model types (LLMs, encoders, diffusion, classical ML), training/inference flows.
  • Data pipelines, feature stores, embeddings, vector databases.
• AI Penetration testing:
  • Prompt injection, model tampering, data poisoning, output manipulation, exfiltration, shadow AI, insecure plugins/integrations.
• Platform & Infra:
  • Kubernetes, containers, API gateways, secrets management, zero trust.
• Observability:
  • Logging, tracing, safety & quality metrics for AI systems.
  • Health and latency monitoring.
• Strong scripting/automation (Python preferred) for security tooling and assessments.

• One or more core security certifications:
  • CISSP, CISM, CCSP, ISO 27001 Lead Implementer/Lead Auditor.
• One or more cloud security certifications:
  • CCSK (Cloud Security Alliance), AWS Security…