AI security review

• Build and improve the AI security review process, including intake forms, risk criteria, assessment templates, configuration standards, and review records.
• Align these with the ISO's existing governance and compliance processes.
• Manage the ongoing AI review queue from intake through documented disposition.
• Prioritize requests by risk, coordinate required reviews, communicate approval conditions, and maintain an inventory of owners, approved uses, restrictions, and reassessment dates.
• Assess AI tools and own the management of their embedded and new features, plugins, connectors, APIs, and agents.
• Examine vendor evidence, prompt retention, model training use, deletion, data flows, and permissions; evaluate exposure to prompt injection, unsafe outputs, and unauthorized actions.
• Document inherent and residual risk, mitigating controls, remediation owners, and due dates.
• Recommend approval, conditional approval, or rejection; track findings until controls are verified or residual risk is accepted by authorized decision makers.
• Perform hands-on security validation with IT and solution owners.
• Review configurations and permissions, test misuse scenarios and access boundaries, and verify data protections, human approval, logging, and rollback before recommending release.
• Reassess approved capabilities when vendors, models, features, integrations, data access, or intended uses change.
• Check configuration drift and control effectiveness, follow corrective actions to closure, and confirm secure access removal and data handling at retirement.

Partnership and enablement

• Own the security controls for the Citizen Developer program.
• Review proposed data access and automated actions, explain security requirements and mitigating controls, and help teams resolve findings before pilots and production use.
• Work closely with the AI team to understand proposed use cases, business needs, and planned implementations.
• Serve as the security liaison between the AI team and IT, translating AI requirements into practical security controls, coordinating risk assessments and technical reviews, and helping resolve security issues throughout adoption and deployment.
• Develop and deliver practical AI security training and guidance for users, Citizen Developers, and administrators.
• Cover sensitive data, output verification, prompt injection, AI-enabled fraud, and incident reporting; use recurring findings to update training.

Incident readiness and reporting

• Maintain and exercise AI incident playbooks.
• Provide investigation and containment expertise during IT-led response, help business owners test fallback procedures, and incorporate lessons learned into controls and guidance.
• Report review volumes, turnaround, assessment coverage, overdue findings, and AI risk trends to the ISO and leadership.
• Maintain audit evidence, escalate unresolved risks, and recommend improvements based on review outcomes and control testing.

• 5+ years in cybersecurity, technology risk, GRC, or security engineering, plus practical experience assessing or securing AI tools or workflows.
• Experience with risk assessments, vendor reviews, and security control testing.
• Working knowledge of enterprise AI assistants, cloud and SaaS controls, identity and access management, APIs, and low-code or no-code platforms.
• Familiarity with ISO 27001 or NIST frameworks, including the NIST AI Risk Management Framework.
• The ability to explain risk in plain language and coordinate technical and business reviews.
• A relevant bachelor's degree or equivalent experience.

• Citizen Developer governance, AI security testing, ISO/IEC 42001, or certifications such as CISSP, CISM, CISA, or CRISC.

• This is an exempt salaried position with a range of $110,000 – $120,000 annually.
• Starting pay is determined based on a thorough evaluation of job-related factors, including geographic location, market conditions, relevant experience, training, and education.
• Full-time employees are eligible for a comprehensive benefits program, including Medical/Prescription drug insurance, Dental, Vision, Health Care/Dependent Care Flexible Spending Account, Health Savings Account, 401(k), Short and Long-Term Disability Insurance, Life/AD&D Insurance, and generous paid time off.

• Send your resume, salary requirements, and a cover letter sharing your relevant experience and why this role interests you.
• A cover letter is required for consideration.