Senior Director, AI ML and Cloud Security

GSK; Camden Town; On-site; GBP 180,000 - 240,000; Full time

Job summary

GSK is seeking a Senior Director for AI ML & Cloud Security to lead a 17-role global function across the UK, India and the US. You will design, govern and elevate AI security standards, ML governance and cloud protection across Azure and GCP, partnering with CSO leadership to drive a strategic security architecture.

You’ll set policy, manage risk and engage regulators while shaping the future of secure AI at scale for GSK’s enterprise AI initiatives and data platforms.

Responsibilities

• Set the three-year plan that moves CSO security services from rule-based to agent-operated, and defend the investment case for it to the CISO and GSK Tech leadership.
• Own the architecture, engineering and secure delivery of the agentic framework transforming security services across the Chief Security Office – agent authorisation models, tool-invocation control, human-in-the-loop gates, trust boundaries and runtime monitoring, designed in from inception.
• Own the design-to-build-to-handover pipeline: specifications engineered faithfully, the data fabric built and tested to specification, and vendor handover packages good enough for a managed service to operate safely from day one.
• Own the AI security standards, reference architectures and threat models binding across CAS and every GSK business AI initiative; no AI capability is architected, built or released without meeting them.
• Lead a 17-role function across five sub-functions and three countries, including leaders of teams, and own its capability and succession plan in a genuinely scarce skills market.
• Own AI platform security governance: agent risk-tiering, LLM and API exposure standards, AI-specific incident response, and the shadow AI discovery programme across the business.
• Own cloud security governance across Azure and GCP on an advisory and standards-setting basis, exercising authority through standards and escalation while platform teams retain remediation.
• Own adversarial AI defence: AI red teaming, prompt and model attack testing, and the mandatory remediation regime that follows, informed by MITRE ATLAS and current research.
• Translate the EU AI Act, NIST AI RMF and ISO/IEC 42001 into architectural requirements ahead of mandated deadlines rather than in response to audit.
• Represent the function to the CISO, GSK Tech leadership, the Enterprise AI programme, auditors and regulators, and own board-level escalation of material AI security risk.

Job description

Senior Director, AI ML & Cloud Security

Why Us!

At GSK, we unite science, technology and talent to get ahead of disease together. We are a global biopharma company with a special purpose - to unite science, technology and talent to get ahead of disease together. We're proud to be leading a healthcare revolution, and we're looking for people who can help us deliver on our ambition

Job Purpose

Lead the function that designs, engineers and governs every AI and machine learning security capability GSK deploys. You own the agentic framework that is modernising security services across the Chief Security Office, the AI and ML platform, and the data fabric that that Cyber Architecture and Solutions designs and builds and a managed service vendor operates. You own the AI security standards that are binding on all GSK AI initiatives - not only those inside that Cyber Architecture and Solutions - and cloud security governance across the Azure and GCP estate. A 17-role function across the UK, India and the US, spanning AI architecture, AI engineering, AI platform and cloud security, business-facing AI advisory, and enterprise AI security authority.

About the team : AI ML and Cloud Security

AI ML and Cloud Security is the function through which GSK is transforming security itself. The team designs and builds the agentic framework, a multi-agent platform moving security services across the Chief Security Office from rule-based to AI-driven operation. It owns AI architecture and AI engineering end to end: the agent layer, LLM orchestration, the AI and ML platform, and the data fabric pipeline that CAS designs, builds and tests before a managed service vendor operates it. The team also governs AI tool security posture, advises on cloud security across the Azure and GCP estate, and is the front door between GSK's business units and R&D and the technical AI function. AI security standards set here are binding on every AI initiative in GSK. Seventeen roles across the UK, India and the US.

What makes this role different.

This is not an AI governance role with an engineering team attached. You will be setting agent authorisation models and trust boundaries where no industry precedent exists and deciding whether an LLM-based control is reliable enough to depend on for a security outcome in a GxP environment where the consequence reaches medicine supply and clinical data. Your architects and engineers work in LangChain, LangGraph, vector databases and production Kubernetes, and they will expect you to follow the detail and challenge it. If your AI experience is policy frameworks, maturity models and vendor assessments, this role will not suit you and the interview will establish that quickly. Equally, if you have deep AI engineering but have never held a security line against a funded programme under delivery pressure, this will be a hard step.

Key Responsibilities

• Set the three-year plan that moves CSO security services from rule-based to agent-operated, and defend the investment case for it to the CISO and GSK Tech leadership.
• Own the architecture, engineering and secure delivery of the agentic framework transforming security services across the Chief Security Office - agent authorisation models, tool-invocation control, human-in-the-loop gates, trust boundaries and runtime monitoring, designed in from inception.
• Own the design-to-build-to-handover pipeline: specifications engineered faithfully, the data fabric built and tested to specification, and vendor handover packages good enough for a managed service to operate safely from day one.
• Own the AI security standards, reference architectures and threat models binding across CAS and every GSK business AI initiative; no AI capability is architected, built or released without meeting them.
• Lead a 17-role function across five sub-functions and three countries, including leaders of teams, and own its capability and succession plan in a genuinely scarce skills market.
• Own AI platform security governance: agent risk-tiering, LLM and API exposure standards, AI-specific incident response, and the shadow AI discovery programme across the business.
• Own cloud security governance across Azure and GCP on an advisory and standards-setting basis, exercising authority through standards and escalation while platform teams retain remediation.
• Own adversarial AI defence: AI red teaming, prompt and model attack testing, and the mandatory remediation regime that follows, informed by MITRE ATLAS and current research.
• Translate the EU AI Act, NIST AI RMF and ISO/IEC 42001 into architectural requirements ahead of mandated deadlines rather than in response to audit.
• Represent the function to the CISO, GSK Tech leadership, the Enterprise AI programme, auditors and regulators, and own board-level escalation of material AI security risk.
• Own the commercial relationship with the m