Director, AI ML and Cloud Security

Description

Director role leading the bridge between the company's AI security function and the business and R&D teams that build with AI, working in both directions.

The AI, ML and Cloud Security team is replacing rule-based security services across the Chief Security Office with AI-driven operation through a multi-agent platform. The team covers AI architecture and engineering (agent layer, LLM orchestration, AI and ML platform, data pipeline), governs AI tool security, advises on Azure and GCP cloud security, and acts as the entry point between business units, R&D and the technical AI function. Security standards set by the team apply to every AI initiative at the company. The team has seventeen roles across the UK, India and the US.

You own the relationship between Cyber Architecture and Solutions and the business functions, R&D and the Enterprise AI programme. You triage AI use-case proposals against architecture standards, classify them for EU AI Act exposure, and send feasible ones into delivery. You will often need to tell senior scientists and business leaders no, while keeping those relationships intact. Unsanctioned AI tool use is an active issue, and the fix is making the governed route quicker than working outside it.

Responsibilities

• Be the single front door for AI security, owning the relationship between Cyber Architecture and Solutions and business functions, R&D and the Enterprise AI programme.
• Triage GenAI, RAG and agentic proposals against AI architecture standards, and move feasible ones into delivery.
• Classify use cases under the EU AI Act and apply NIST AI RMF risk framing, including AI in GxP-validated and clinical settings.
• Make the proceed, redesign or refuse decision on every AI use case brought in by business units and R&D, and sign the decisions recorded in the pipeline register.
• Represent the Cyber Architecture and Solutions security position in AI governance forums and Responsible AI decisions.
• Own AI risk and priority scoring across the use-case portfolio so that sequencing rests on evidence, not on who pushes hardest.
• Find unsanctioned business-side AI tools and bring them under governance by making the approved route faster, not by blocking people.
• When a funded AI programme cannot go ahead as designed, hold the security position with R&D and business leaders and keep the relationship intact.
• Hold the security line with senior scientists and business leaders, and escalate any use case that cannot proceed safely.
• Sit on the Enterprise AI programme board and the Responsible AI council, and present the quarterly demand forecast that sets AI Engineering's build priorities.

Requirements

• Degree in a relevant discipline, or equivalent depth shown through experience.
• Significant experience in cyber security, AI governance or technology risk, including leading teams, with a focus on business-facing AI work with business units and R&D, and owning the business-facing relationship for an enterprise AI programme.
• Experience leading AI use-case intake and triage, assessing business and R&D proposals against security and architecture requirements and routing feasible ones into delivery, using automated intake and tracking.
• Experience working with the Enterprise AI team and AI governance forums, shaping GenAI, LLM and agent adoption before decisions are made rather than reviewing afterwards.
• Ability to turn AI security constraints into practical guidance for business projects and to explain the AI security roadmap to senior business stakeholders.
• Experience finding business-side shadow AI and fixing unsanctioned tools through relationships rather than enforcement alone.
• Preferred: awareness of EU AI Act, NIST AI RMF and ISO/IEC 42001 in a regulated setting.
• Preferred: experience assessing AI risk, prioritising use cases by risk, and automating governance checks.
• Preferred: experience telling an R&D leadership team that a funded AI programme cannot proceed as designed, while keeping the relationship.
• Preferred: experience in a regulated industry, ideally pharmaceutical (GxP).
• Preferred: AI governance or privacy certification such as IAPP AIGP or CIPP/E.

Conditions

Based in the United Kingdom, hybrid, with a minimum of 2 to 3 days a week onsite at the central London headquarters.

Closing date: 6 November 2026.

Equal-opportunity statement: the company welcomes applications from all backgrounds.

Adjustment requests for the application process go to the company's site. Recruitment agencies must have written authorisation from the company before referring candidates; unauthorised referrals are not paid.