AI Security Governance Architect

Are you passionate about helping organizations turn complex AI security challenges into clear strategies and practical solutions? At Plain Concepts, our AI Security Studios team helps organizations adopt AI securely and responsibly by defining how risks, controls, and responsibilities should be managed throughout the AI lifecycle.

As an AI Security Governance Architect, you will help design and operationalize cybersecurity governance frameworks for AI, Generative AI, and agentic AI, working closely with security, architecture, and business teams. You will act as a cybersecurity subject matter expert for AI governance, translating emerging AI risks into practical security controls, requirements, processes, and architecture patterns that organizations can actually implement.

Key Responsibilities

• Define and evolve AI security governance frameworks, covering AI use case registration, risk classification, security controls, approvals, exceptions, monitoring, and periodic reassessment.
• Align AI security governance with recognized standards and regulations, including NIST AI RMF, NIST Generative AI Profile, ISO/IEC 42001, OWASP Top 10 for LLM Applications, and the EU AI Act.
• Assess AI, GenAI, and agentic AI use cases from a cybersecurity perspective, considering risks such as prompt injection, sensitive data leakage, identity and access management, excessive agent permissions, model exposure, third-party AI services, data residency, and AI supply chain risks.
• Translate AI risks into practical security controls, including security policies, technical requirements, architecture patterns, guardrails, evidence requirements, ownership, and acceptance criteria.
• Define security requirements and architecture patterns for different AI scenarios, including internal copilots, Microsoft 365 Copilot, custom GenAI applications, RAG systems, AI agents, ML models, vendor AI solutions, and low-code/no-code AI automations.
• Integrate AI security governance with existing security tooling and processes, including solutions such as HiddenLayer, Sentra, and Zenity, as well as GRC, IAM, DLP, SIEM/SOC, cloud security, CMDB, and data governance environments.
• Define and improve AI security governance deliverables, including AI security control frameworks, use case classification models, security requirements, architecture patterns, risk acceptance processes, security review templates, KPI/KRI dashboards, and maturity roadmaps.

Requirements

• 8+ years of experience in cybersecurity, with a strong background in security governance, security architecture, risk management, AppSec, or Cloud Security.
• Strong understanding of AI and GenAI security risks, including LLM application security, prompt injection, sensitive data leakage, RAG security, AI agent permissions, model/API exposure, model supply chain, and third-party AI services.
• Experience designing and operationalizing security governance and control frameworks, with the ability to turn policies and risk requirements into practical controls, processes, and security requirements.
• Knowledge of AI security and governance frameworks, such as NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLM Applications, and related AI risk and security standards.
• Ability to work across security, architecture, and business teams, translating complex cybersecurity risks into clear requirements and recommendations for both technical and executive stakeholders.
• Excellent communication and documentation skills, with the ability to create executive-ready materials as well as detailed security and control documentation.
• Fluent in English and Spanish.

Nice to Have

• Experience with AI governance programs, GenAI security assessments, or AI Security Posture Management (AISPM).
• Experience securing enterprise AI environments such as Microsoft 365 Copilot, custom GenAI applications, RAG solutions, or AI agents.
• Knowledge of cloud security architecture, Secure SDLC/DevSecOps, DSPM, GRC, or AI-related SOC monitoring.
• Familiarity with tools such as HiddenLayer, Sentra, Zenity, Wiz, Microsoft Purview, Defender, CSPM/CWPP, DLP, or SIEM/SOAR platforms.
• Knowledge of third-party AI risk management and security control evidence automation.
• Understanding of privacy and AI regulatory requirements, including GDPR, DPIAs, data classification, and the EU AI Act.