Lead - Security & AI Governance

Job Description:

Experience Required:

- 8-10 years of experience in security, risk, or governance roles, including at least 3 years focused specifically on AI/ML governance, responsible AI, or model risk management.

Key Responsibilities:

- Entitlements & Access Control: Define and enforce entitlement and access-control policies across all platform capabilities, ensuring data and model access are never granted beyond what a user's role permits.

- Audit Trail Design: Own the audit trail design so that every routing decision, model call, and human action is logged, reviewable, and reproducible.

- Evaluation Harness: Design and maintain the evaluation harness used to test AI outputs for accuracy, bias, safety, and policy compliance before and after release.

- Responsible-AI Reviews: Lead responsible-AI reviews for new capabilities, agents, or model changes prior to production rollout.

- AI Guardrails: Establish and monitor guardrails against prompt injection, data exfiltration, unsafe tool use, and other AI-specific risks.

- Data Classification & Privacy: Define data classification, redaction, and privacy-by-design requirements (e.g., PII/PHI handling) in partnership with legal and compliance stakeholders.

- Model Change Management: Own model versioning, rollback, and change-management policy so that any production issue can be traced and reversed.

- Audit & Compliance Liaison: Serve as the primary point of contact for internal and external audits, security reviews, and compliance questions related to the platform.

- Governance by Design: Partner with solution architects and engineering leads to ensure governance requirements are reflected in system design, not retrofitted after build.

Qualifications:

- Demonstrated experience building or governing AI/ML systems in a regulated or high-compliance environment.

- Strong understanding of access control models (role-based, attribute-based) and entitlement enforcement patterns.

- Familiarity with AI safety and evaluation frameworks, including bias, groundedness, and adversarial-robustness testing.

- Experience with audit logging, data lineage, and reproducibility requirements.

- Working knowledge of data privacy regulations and privacy-by-design principles.

- Strong stakeholder communication skills - able to translate technical risk into business-relevant terms for leadership and auditors.

- Experience in pharmaceutical, healthcare, or other highly regulated industries.