Senior Principal - AI ML and Cloud Security

14260 GSK India Global Services Private Limited; Bengaluru; On-site; INR 4,000,000 - 6,500,000; Full time

Job summary

GSK is seeking a senior AI security governance specialist in Bengaluru to own AI standards and architecture governance. You will run architecture quality reviews and maintain the threat-model library to ensure alignment with approved specifications.

Lead the governance framework, translate major AI acts into practical requirements, and mentor engineers on responsible AI practices, while guiding the standards roadmap.

Qualifications

• 15+ years in cyber security in a regulated environment with AI focus.
• Experience building and maintaining the enterprise AI security standards library.
• AI threat model library and risk-tiering mapped to MITRE ATLAS and OWASP LLM Top 10.
• Running AI architecture governance — reviews, conformance and gates.
• Owning the architecture decision log with policy-as-code checks where possible.

Responsibilities

• Develop and maintain the AI security standards library and governance framework.
• Run architecture quality reviews validating engineering against approved specs.
• Own the architecture decision log for audit traceability.
• Build and maintain the AI threat model library (prompt injection, data risks).
• Translate EU AI Act, NIST RMF and ISO/IEC 42001 into practical requirements.
• Define governance gates before build, release or vendor handover.
• Mentor colleagues on standards and governance practice.
• Lead the team in using approved AI tools and responsible AI.

Skills

AI Architecture

Threat Modelling

Architecture Governance

Policy as Code

MITRE ATLAS

Education

Bachelor's degree or equivalent

Tools

Azure Policy

OPA

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges. Domain focus: AI Architecture & Standards (AI security standards, AI threat modelling and model/agent risk tiering).

Job Purpose: Own the AI security standards library and the architecture governance framework for Cyber Architecture and Solutions.Own the AI security standards library and the architecture governance framework for Cyber Architecture and Solutions. This role owns standards and governance rather than solution design, which sits with AI Architecture. You run the quality reviews that confirm what Engineering built matches what Architecture specified, own the architecture decision log, and maintain the AI threat model library. The standards you write are binding on AI initiatives well beyond Cyber Architecture and Solutions.

About the team

AI ML and Cloud Security is the function through which GSK is transforming security itself. The team designs and builds the agentic framework, a multi‑agent platform moving security services across the Chief Security Office from rule‑based to AI‑driven operation. It owns AI architecture and AI engineering end to end: the agent layer, LLM orchestration, the AI and ML platform, and the data fabric pipeline that Cyber Architecture and Solutions designs, builds and tests before a managed service vendor operates it. The team also governs AI tool security posture, advises on cloud security across the Azure and GCP estate, and is the front door between GSK's business units and R&D and the technical AI function. AI security standards set here are binding on every AI initiative in GSK.

Seventeen roles across the UK, India and the US.

What makes this role different

This is the quality gate on GSK's AI work. It suits someone who writes with real precision and enjoys building the framework rather than shipping the feature — the value shows up as problems that never happened. You need enough hands‑on AI depth to tell a genuine control from a plausible‑sounding one, because vendors and internal teams will present both. If you want to be building agents, apply for the engineering roles instead.

Key responsibilities

• Develop and maintain the AI security standards library and the architecture governance framework.
• Run architecture quality reviews validating that Engineering builds match approved specifications.
• Own the architecture decision log so design rationale stays traceable for audit and regulatory inspection.
• Build and maintain the AI threat model library: prompt injection including indirect, training data poisoning, model extraction, adversarial input, agent privilege escalation.
• Translate the EU AI Act, NIST AI RMF and ISO/IEC 42001 into practical architectural requirements rather than restating them.
• Define the governance gates an AI capability must pass before build, release or vendor handover.
• Hold office hours for the engineering teams and turn the three most‑asked questions each quarter into new pattern guidance, so the same exception is not requested twice.
• Support assurance, audit and regulatory evidence requests from the governance framework.
• Re‑baseline the standards library against each new OWASP Top 10 for LLM Applications revision, NIST AI RMF profile and EU AI Act implementing act within 60 days of publication.
• Mentor colleagues on standards and governance practice.
• Lead your team in using approved AI tools to improve productivity and ways of working, role‑modelling responsible use and follow GSK's ;Responsible AI, privacy and security requirements.
• Own the standards roadmap — which standards are being written, revised or retired, and by when — so the library stays ahead of the build rather than behind it.

Basic Qualifications

• 15+ years in cyber security in a regulated environment — domain focus: AI Architecture & Standards (AI security standards, AI threat modelling and model/agent risk tiering)
• Building and maintaining the enterprise AI security standards library, translating the EU AI Act, NIST AI RMF and ISO/IEC 42001 into practical, enforceable architectural requirements
• AI threat model library and risk‑tiering methodology — direct and indirect prompt injection, training‑data poisoning, model extraction, adversarial input and agent misuse — mapped to MITRE ATLAS and OWASP LLM Top 10
• Running AI architecture governance — reviews, conformance, exceptions and quality reviews validating engineering builds against approved specifications, with gates before build, release or vendor handover
• Owning the architecture decision log so AI design rationale is traceable for audit and regulatory inspection, with policy‑as‑code conformance checks where possible

Preferred Qualifications

• EU AI Act, NIST AI RMF and ISO/IEC 42001 working knowledge
• GxP and data integrity requirements applied to AI systems
• Evidencing AI governance to internal audit or regulators
• Rego and OPA or Azure Policy authoring, so conformance checks run in the pipeline rather than in a review meeting.
• AI red‑teaming and adversarial testing methods used to validate standards
• Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.

Typical tools and technologies: AI security standards authoring, AI threat modelling using MITRE ATLAS and STRIDE adapted for machine learning, model and agent risk tiering frameworks, EU AI Act, NIST AI RMF and ISO/IEC 42001, OWASP Top 10 for LLM Applications, architecture decision records and conformance review, GxP‑compliant documentation and evidence management.

#AGTech Skills

• AI Architecture
• AI for Cybersecurity
• AI System Design
• Application Security
• Cloud Security
• Cloud Security Cryptography
• Cloud Software
• Computer Programming
• Data Security
• Identity Access Management (IAM)
• Information Systems
• Infrastructure Security
• ML Security
• Operating Systems Security
• Scripting
• Security Engineering
• Security Technologies
• Security Testing
• Threat Modeling
• Threat Modeling for AI Systems
• Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people. Inclusion at GSK: As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process. Please contact our Recruitment Team at [e-mail] to discuss your needs.

We are a global biopharma company with a special purpose – to unite science, technology and talent to get Ahead Together. We can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. Getting ahead means preventing disease as well as treating it, and we aim to impact the health of 2.5 billion people around the world in the next 10 years. Our success absolutely depends on our people. While getting ahead of disease together is about our ambition for patients and shareholders, it’s also about making GSK a place where people can thrive. We want GSK to be a place where people feel inspired, encouraged and challenged to be the best they can be. A place where they can be themselves – feeling welcome, valued and included. Where they can keep growing and look after their wellbeing. So, if you share our ambition, join us at this exciting moment in our journey to get Ahead Together. Find out more on our career site.