Expert SecOps AI

Project overview

The client is strengthening the security of its AI usage and capitalizing on its SecOps controls.

The scope covers three distinct sets: the generative AI platform, IA4ALL, and UiPath. IA4ALL and UiPath remain outside the product scope of the Gen AI platform, while sharing needs for governance, access control, testing, and traceability.

The system already has an AI Gen platform security referent and concrete work has been done: transverse coordination, access and isolation controls for the LLM gateway, observability, security testing, and follow-up on audit recommendations. The mission aims to consolidate these achievements, make them reusable, and support evolving uses.

The need is for a single dedicated reinforcement combining security support for IA4ALL/UiPath and transverse SecOps missions. This reinforcement complements the current referent; it does not replace them and is not a general platform engineering position.

The work notably concerns PSP requirements and C3/C4 data usage, MCP tool agents and access, security testing and red teaming, detection of unreferenced AI usage, AI security posture, open models, and preparation for Run.

Interventions are prioritized according to risks, project needs, dependencies, and available capacity. Contractual terms, workload, and duration are detailed in the dedicated fields after validation.

Description

The senior transverse AI SecOps Expert ensures an operational security role: requirement analysis, control implementation and verification, testing, automation, integration, observability, evidence, and operational readiness.

This role combines two families of missions in a single position: IA4ALL/UiPath security and transverse SecOps. They work in complement to the AI Gen platform security referent, with operational autonomy and in collaboration with the SecOps, DRG, Governance, architecture, platform, projects, and production teams.

Responsibilities

Positioning and Limitations:

What characterizes the profile:

Demonstrated operational security practice, understanding of AI risks, and ability to produce reusable controls and evidence. The candidate must be able to explain a control that has been implemented, its testing, its limitations, its remediation, and its handover to another team.

Deliverables

L1. Inventory and prioritized security backlog: scopes, controls, available evidence, gaps, dependencies, and proposed owners.

L2. IA4ALL/UiPath security files and PSP reviews for the selected scope: flows, requirements, envisioned architectures, gaps, evidence, and expected decisions.

L3. Reusable control patterns and sheets: applicability conditions, limitations, and verification procedures.

L4. Versioned, repeatable, and documented security and regression test pack.

L5. Contributions to solution and model evaluations: criteria, scenarios, results, limitations, and integration into the decision-making process.

L6. Evidence file and decision sheet linking uses, versions, controls, results, and gaps.

L7. Runbooks and operational security procedures, reviewed with handover owners.

L8. Tracking table and control adoption matrix, distinguishing applicability, deployment, and evidence.

L9. Transfer file and prioritized remaining tasks, with handed-over assets and identified handover owners.

Volumes, priority scopes, and acceptance criteria are agreed upon at the start. No security Go-live or complete industrialization of all tasks is guaranteed solely by the delivery of a deliverable.

• IA4ALL/UiPath Security and PSP / C3-C4 Scoping
• Gather usage, data, flows, connectors, identities, and action possibilities.
• Contribute to PSP reviews with architects: requirements, feasibility, phased architectures, gaps, and expected evidence.
• Analyze deployment conditions and supplier evidence, particularly isolation, privileged access, keys, logs, location, and reversibility according to applicable requirements.
• Formalize with stakeholders the rules for using the Gen AI platform/agent for access to models, tools, and connectors.
• Access Controls, Gateway, and Secure Observability
• Verify SSO controls, authorizations, secrets, key rotation, and use case separation for assigned activities.
• Contribute to reviews of component and model changes, with relevant re-testing.
• Analyze the protection of logs and traces, their isolation, access rights, retention, and supervision needs, without assuming existing configurations.
• Follow up on remediation with technical leads and produce associated evidence.
• AI Security and Regression Testing
• Build direct/indirect injection, jailbreak, exfiltration, tool abuse, and authorization defect scenarios adapted to usage.
• Execute or contribute to authorized tests, analyze results, and verify corrections.
• Gradually automate repeatable tests and their integration into delivery.
• Consolidate existing audits and tests into a reusable package, with limitations and conditions of application.
• Agent Patterns, MCP, RAG, and Open Models
• Implement least privilege controls, human validation, execution isolation, and action traceability.
• Distinguish model access from MCP tool access and document applicable rules.
• Scope Secure RAG, web search, and code execution controls according to selected uses.
• Contribute to the qualification of open models: origin, license, version, hosting, testing, and revalidation conditions.
• Security Solution Qualification
• Translate needs into criteria and scenarios for red teaming, Shadow IT/Shadow AI, and AI-SPM.
• Contribute to POCs and benchmarks led by the SecOps team, documenting coverage, limitations, false positives, and integration constraints.
• Provide technical expertise for vendor discussions and the remediation process, without creating parallel management.
• Capitalization, Production Deployment, and Run
• Link requirements, controls, versions, results, gaps, and decisions in an exploitable evidence file.
• Prepare security deliverables for production deployments and the conditions for maintaining controls.
• Produce runbooks for the assigned scope and contribute to supervision and escalation processes.
• Document on the go, transfer knowledge, and return assets to authorized internal spaces.
• A single reinforcement, not two additional people or a replacement for the current referent.
• No general responsibility for platform construction, FinOps, business use case delivery, or 24/7 operations.
• No autonomous risk acceptance, C3/C4 exception, or production deployment decision outside the authorized process.
• The role contributes to solution choices and vendor discussions within the target organization's planned SecOps team management.
• Offensive testing, data access, and production changes are subject to authorization.
• Activities are prioritized; comprehensive portfolio coverage and simultaneous industrialization are not assumed.

Project details

• Start: ASAP
• Duration: 3 mois renouvelable
• Location: Île-de-France, France, FR
• Languages: French