AI Security SME

You will lead the security architecture, governance, and assurance of our AI and GenAI platforms across the organization. This includes classical ML systems and modern LLM/agentic architectures. You will define how models are designed, deployed, monitored, and defended; ensure they are robust, explainable, privacy-preserving, and compliant; and act as the go-to expert for AI security across products, data, cloud, and security teams.

• AI Security Architecture
• Design and review secure architectures for ML/LLM workloads (training, fine tuning, inference, RAG, agents, plugins, tool calling, APIs).

• Define reference architectures for on-prem, hybrid, and cloud AI platforms (Azure OpenAI, AWS Bedrock, GCP Vertex, self-hosted models, etc.).

• Threat Modeling & Risk Management
• Perform AI-specific threat modeling (e.g., data poisoning, model theft, prompt injection, jailbreaks, supply-chain, inference attacks) using MAESTRO or similar framework.

• Align controls with leading frameworks: NIST AI RMF, ISO/IEC 27001, ISO/IEC 27090, ISO/IEC 42001, OWASP GenAI / LLM Top 10, CSA & MITRE ATLAS.

• Security Control Design & Implementation
• Define and oversee implementation of controls for:
• Training & data pipelines (data quality, provenance, labeling, PII protection).

• Model & artifact integrity (signing, SBOM, secure registries).

• Access control, isolation, rate limiting, and abuse detection.

• Secure prompt engineering and guardrail policies.

• Security prompt monitoring to detect ongoing attacks.

• Data security: data classification, data masking and DLP.

• MCP server hardening.

• Reliability & Trustworthiness
• Partner with engineering and data science to embed robustness, observability, fallback strategies, and evaluation pipelines (safety, bias, toxicity, hallucination monitoring).

• Contribute to SLOs/SLAs for AI systems, including security and reliability KPIs.

• Secure SDLC for AI
• Embed AI security into CI/CD: scanning, dependency checks, policy-as code, red-teaming AI components pre- and post-release.

• Incident Response & Red Teaming
• LLM bias detection.

• Perform red teaming activities to abuse and force AI hallucinations.

• Develop and maintain AI-specific playbooks (prompt abuse, model exfiltration, data leakage, compromised agents).

• Lead or support AI red/blue/purple teaming exercises using frameworks like MITRE ATLAS.

• Governance, Compliance & Policy
• Advice on alignment with emerging AI regulations and standards (e.g., EU AI Act, regional laws, internal AI use policies).

• Define internal policies on responsible AI, data usage, model lifecycle, and 3rd-party AI risk management.

• Stakeholder Leadership
• Run workshops, training, and awareness for engineering, security, and business teams.

Required Qualifications & Experience:

• 8–12+ years in Cybersecurity, with 3–5+ years focused on AI/ML or data platforms (can be overlapping).

• Hands-on experience with:
• Cloud platforms (Azure, AWS, GCP) and their AI services.

• At least one Agentic/GenAI stack (e.g., Transformers, LangChain/LlamaIndex, vector DBs, model gateways, MLOps platforms).

• Proven track record designing or reviewing secure architectures for:
• ML pipelines, LLM/RAG systems, or agentic/automation platforms.

• Strong understanding of:
• Cryptography, identity & access management, network & app security.

• Data protection & privacy (PII, PHI, DPIA concepts).

• Experience working with or mapping to frameworks/standards such as:
• NIST AI RMF, ISO/IEC 27001, ISO/IEC 42001, SOC 2, OWASP Top 10 & OWASP GenAI/LLM Top 10, MITRE ATT&CK/ATLAS, CSA guidance.

• Excellent communication skills: able to translate complex AI risks into clear business and technical requirements.

Core Technical & Domain Skills:

• AI/ML & GenAI fundamentals:
• Model types (LLMs, encoders, diffusion, classical ML), training/inference flows.

• Data pipelines, feature stores, embeddings, vector databases.

• AI Penetration testing:
• Prompt injection, model tampering, data poisoning, output manipulation, exfiltration, shadow AI, insecure plugins/integrations.

• Platform & Infra:
• Kubernetes, containers, API gateways, secrets management, zero trust.

• Observability:
• Logging, tracing, safety & quality metrics for AI systems.

• Health and latency monitoring.

• Strong scripting/automation (Python preferred) for security tooling and assessments.

Certifications & Training (Required / Highly Desirable):

Essential:

• One or more core security certifications:
• CISSP, CISM, CCSP, ISO 27001 Lead Implementer/Lead Auditor.

• One or more cloud security certifications:
• CCSK (Cloud Security Alliance), AWS Security Specialty, Azure Security Engineer, Google Professional Cloud Security Engineer.

• AI & AI Security–specific training / certs (or commitment to obtain within 6–12 months):
• NIST AI RMF or ISO/IEC 42001-focused training.

• Certified AI Security Professional (CAISP / similar offerings that cover LLM/GenAI threats, MITRE ATLAS, OWASP LLM Top 10).

• OffSec / similar LLM & AI Red Teaming or GenAI security courses.

• Vendor AI/ML certifications (Azure AI Engineer, AWS Machine Learning Specialty, GCP ML Engineer) with demonstrated security emphasis.

Additional desirable:

• GIAC/GWAPT/GXPN/GCLD or similar offensive / cloud / Appsec certs.

• Formal training in:
• Secure MLOps & ML supply-chain security.

• Privacy engineering & data protection (e.g., CIPT, CDPSE).

• OWASP GenAI / LLM Top 10, MITRE ATLAS, CSA MAESTRO & other AI risk frameworks.