Security and AI Governance Lead

EXPERIENCE REQUIRED

810 years of experience in security, risk, or governance roles, including at least 3 years focused specifically on AI/ML governance, responsible AI, or model risk management.

KEY RESPONSIBILITIES

• Entitlements & Access Control: Define and enforce entitlement and access-control policies across all platform capabilities, ensuring data and model access are never granted beyond what a user's role permits.
• Audit Trail Design: Own the audit trail design so that every routing decision, model call, and human action is logged, reviewable, and reproducible.
• Evaluation Harness: Design and maintain the evaluation harness used to test AI outputs for accuracy, bias, safety, and policy compliance before and after release.
• Responsible-AI Reviews: Lead responsible-AI reviews for new capabilities, agents, or model changes prior to production rollout.
• AI Guardrails: Establish and monitor guardrails against prompt injection, data exfiltration, unsafe tool use, and other AI-specific risks.
• Data Classification & Privacy: Define data classification, redaction, and privacy-by-design requirements (e.g., PII/PHI handling) in partnership with legal and compliance stakeholders.
• Model Change Management: Own model versioning, rollback, and change-management policy so that any production issue can be traced and reversed.
• Audit & Compliance Liaison: Serve as the primary point of contact for internal and external audits, security reviews, and compliance questions related to the platform.
• Governance by Design: Partner with solution architects and engineering leads to ensure governance requirements are reflected in system design, not retrofitted after build.

QUALIFICATIONS

• Demonstrated experience building or governing AI/ML systems in a regulated or high-compliance environment.
• Strong understanding of access control models (role-based, attribute-based) and entitlement enforcement patterns.
• Familiarity with AI safety and evaluation frameworks, including bias, groundedness, and adversarial-robustness testing.
• Experience with audit logging, data lineage, and reproducibility requirements.
• Working knowledge of data privacy regulations and privacy-by-design principles.
• Strong stakeholder communication skills — able to translate technical risk into business-relevant terms for leadership and auditors.
• Experience in pharmaceutical, healthcare, or other highly regulated industries.