AI Security Officer

Project overview

Context

As part of the development of its uses of artificial intelligence, particularly generative AI, large language models (LLMs), Retrieval-Augmented Generation (RAG) architectures, and AI agents, a large asset management company wishes to strengthen its control over the cybersecurity risks associated with these technologies.

The mission consists of acting as an AI Security Officer to support the secure adoption of artificial intelligence.

The selected person will be the main point of reference on AI-related security topics. They will contribute with the architecture, development, data, and innovation teams, as well as with the managers of the relevant solutions and projects.

The profile for the mission must combine:

Missions

The subject will act as the AI Security referent and will support stakeholders in identifying, assessing, and managing security risks related to artificial intelligence solutions.

• In-depth technical expertise in AI systems security;
• Mastery of risk analysis and management methods;
• Ability to support technical and non-technical teams;
• Capacity to clearly communicate risks and recommendations.

Responsibilities

Technical Domains Covered

Mission Frameworks

Practical knowledge of the main standards and frameworks applicable to AI Security is expected, including:

• Technical expertise on AI architectures and solutions, including LLMs, RAG architectures, and AI agents;
• Analysis of architectures, data flows, components, dependencies, and third-party solutions;
• Identification and assessment of security risks related to models, data, access, suppliers, and external components;
• Discussion of technical choices and definition of appropriate risk reduction measures;
• Contribution to security reviews and ensuring follow-up of deviations, remediation plans, exceptions, and residual risks;
• Definition of the evolution of the AI Security reference framework, including the risk analysis methodology, threat scenarios, security controls and baselines, validation criteria, and monitoring indicators;
• Ensuring monitoring of emerging threats, standards, and practices in AI Security.
• LLM and Generative AI: definition and evaluation of security measures covering prompt injection, data and secrets protection, as well as securing tools, APIs, and connectors.
• RAG Architectures: securing the RAG chain, including knowledge sources, access controls, ingestion and retrieval mechanisms, embeddings, indexes, and vector databases.
• AI Agents: securing identities, permissions, secrets, and action capabilities of agents, including least privilege, validation of sensitive operations, traceability, and control and revocation mechanisms.
• Secure SDLC and DevSecOps applied to AI: integration of AI Security requirements into the solution lifecycle, including security gates, component assessment, AI-specific security testing, and automation of controls in CI/CD pipelines.
• OWASP;
• OWASP Top 10 for LLM/GenAI;
• MITRE ATLAS;
• NIST AI Risk Management Framework (AI RMF).

Project details

• Start: flexible
• Remote: hybrid
• Location: Paris, France, FR
• Languages: French