Application Security (AI Security)

Role & responsibilities

• Define the roadmap and operating model for AI Security, Red Teaming and AI BOM capabilities.
• Identify and prioritize assessment themes based on business criticality, threat intelligence, technology changes and regulatory expectations.
• Define secure AI lifecycle requirements covering model, data, prompts, APIs, agents, third- party components and deployment environments.
• Establish AI BOM inventory, ownership, classification, review, exception and lifecycle processes.
• Define rules of engagement, authorization, evidence handling, remediation validation and closure criteria for red-team exercises.
• Support secure adoption of AI initiatives by providing security inputs during design, onboarding, procurement and change reviews.
• Assess new tools, services and vendor capabilities relevant to AI security and offensive security.
• Plan and conduct authorized in-house red-team exercises and adversarial testing for defined themes.
• Track findings, root causes, remediation plans, retesting and risk acceptance to closure.
• Maintain dashboards covering assessment coverage, vulnerabilities, aging, exceptions, AI BOM completeness and control effectiveness.
• Provide concise management reporting on material risks, trends, dependencies and improvement actions.
• Coordinate with Technology, SOC, Threat Intelligence, Data Science, AI/ML, Cloud, Architecture, Risk, Compliance and Audit teams.
• Translate technical findings into clear business risk and actionable remediation guidance.
• Engage business and product teams to understand AI use cases, critical assets and security requirements.
• Promote timely remediation while enabling secure and responsible technology adoption.
• Ensure all testing is authorized, controlled and performed within approved scope and rules of engagement.
• Maintain confidentiality, integrity and traceability of sensitive information, test evidence and reports.
• Identify control gaps, recommend mitigations and verify sustainable closure.
• Support audit, regulatory and internal control reviews with accurate evidence and status.
• Guide team members and vendor resources, allocate work and review technical quality and delivery.
• Demonstrate strong work ethics, integrity, accountability, communication and collaborative leadership.
• Build technical capability through knowledge sharing, mentoring and awareness of emerging developments.

Preferred candidate profile

• Bachelors degree in Computer Science, Information Technology, Cybersecurity, Engineering or a related discipline.
• Masters degree and relevant certifications in offensive security, cloud security, AI/ML security or information security are preferred.
• 10+ years of Cybersecurity experience, with strong exposure to offensive security, application security, red teaming or security engineering.
• Hands-on knowledge of AI/ML security, adversarial testing, GenAI and LLM risks, model and data security, prompt injection, agentic AI risks and AI supply-chain security.
• Experience in planning and executing red-team exercises, validating findings and driving remediation with internal teams and vendors.
• Experience establishing inventories or BOM-based governance for AI models, datasets, libraries, frameworks, APIs, third-party services and dependencies.
• Prior banking or financial-services experience is preferred.
• Technically strong in AI security testing, threat modelling, red teaming and vulnerability validation
• Knowledge of secure SDLC, cloud, APIs, identity, data protection, logging and incident response.
• Ability to interpret new attack techniques, research and technology developments
• Governance, process design, audit evidence and risk reporting
• Vendor assessment, scope definition and delivery oversight