Expert SecOps AI

Project overview

Context

The client is strengthening the security of its artificial intelligence uses and capitalizing on its SecOps controls.

The scope covers three distinct sets: the generative AI platform, IA4ALL, and UiPath. IA4ALL and UiPath remain outside the product scope of the Gen AI platform, while sharing needs for governance, access control, testing, and traceability.

The system already has an AI Gen platform security referent and concrete work has been done: transverse coordination, access and LLM gateway segmentation controls, observability, security testing, and audit recommendation tracking. The mission aims to consolidate these achievements, make them reusable, and support evolving uses.

The need is for a single dedicated reinforcement combining IA4ALL/UiPath security support and transverse SecOps missions. This reinforcement complements the current referent; it does not replace them and is not a general platform engineering position.

The work specifically concerns PSP requirements and C3/C4 data uses, MCP tool agents and access, security testing and red teaming, detection of unreferenced AI uses, AI security posture, open models, and preparation for Run.

Interventions are prioritized according to risks, project needs, dependencies, and available capacity. Contractual terms, workload, and duration are detailed in the dedicated fields after validation.

Missions

The senior transverse Expert SecOps AI ensures an operational security role: requirement analysis, control implementation and verification, testing, automation, integration, observability, evidence, and operational preparation.

It combines two families of missions in a single role: IA4ALL/UiPath security and transverse SecOps. It works in conjunction with the AI Gen platform security referent, with operational autonomy and in collaboration with the SecOps, DRG, Governance, architecture, platform, projects, and production teams.

Responsibilities

Positioning and Limitations:

Tools & Environment

Deliverables

Volumes, priority scopes, and acceptance criteria are agreed upon at the start. No security Go-live or complete industrialization of all tasks is guaranteed solely by the delivery of a deliverable.

Working Conditions

• IA4ALL/UiPath Security and PSP / C3-C4 Scoping
• Gather uses, data, flows, connectors, identities, and action possibilities.
• Contribute to PSP reviews with architects: requirements, feasibility, phased architectures, gaps, and expected evidence.
• Analyze deployment conditions and supplier evidence, particularly isolation, privileged access, keys, logs, location, and reversibility according to applicable requirements.
• Formalize with stakeholders the rules for using the Gen AI platform/agent for access to models, tools, and connectors.
• Access Controls, Gateway, and Secure Observability
• Verify SSO controls, authorizations, secrets, key rotation, and separation of use cases for entrusted activities.
• Contribute to reviews of component and model changes, with relevant re-testing.
• Analyze the protection of logs and traces, their segmentation, access rights, retention, and monitoring needs, without assuming existing configurations.
• Track remediation with technical managers and produce associated evidence.
• AI Security and Regression Testing
• Build direct/indirect injection, jailbreak, exfiltration, tool abuse, and authorization defect scenarios adapted to uses.
• Execute or contribute to authorized tests, analyze results, and verify corrections.
• Gradually automate repeatable tests and their integration into delivery.
• Capitalize on existing audits and tests in a reusable pack, with limitations and application conditions.
• Agent, MCP, RAG, and Open Model Patterns
• Implement least privilege controls, human validation, execution isolation, and action traceability.
• Differentiate between model access and MCP tool access, and document applicable rules.
• Scope Secure RAG, web search, and code execution controls according to selected uses.
• Contribute to the qualification of open models: origin, license, version, hosting, testing, and revalidation conditions.
• Security Solution Qualification
• Translate needs into criteria and scenarios for red teaming, Shadow IT/Shadow AI, and AI-SPM.
• Contribute to POCs and benchmarks led by the SecOps team, documenting coverage, limitations, false positives, and integration constraints.
• Provide technical expertise for vendor discussions and the remediation process, without creating parallel management.
• Capitalization, Production Deployment, and Run
• Link requirements, controls, versions, results, gaps, and decisions in an exploitable evidence file.
• Prepare security deliverables for production deployments and conditions for control maintenance.
• Produce runbooks for the assigned scope and contribute to monitoring and escalation processes.
• Document on the fly, transfer knowledge, and return assets to authorized internal spaces.
• A single reinforcement, not two additional people or a replacement for the current referent.
• No general responsibility for platform construction, FinOps, business use case delivery, or 24/7 operations.
• No autonomous risk acceptance, C3/C4 exception, or decision to go into production outside the authorized process.
• The role contributes to solution choices and vendor discussions within the target organization's SecOps team management.
• Offensive testing, data access, and production changes are subject to authorization.
• Activities are prioritized; completeness of the portfolio and simultaneous industrialization are not assumed.
• API
• CI/CD
• Git
• MCP
• PSP
• Python
• RAG
• UiPath
• L1. Status report and prioritized security backlog: scopes, controls, available evidence, gaps, dependencies, and proposed owners.
• L2. IA4ALL/UiPath security files and PSP reviews for the selected scope: flows, requirements, proposed architectures, gaps, evidence, and expected decisions.
• L3. Reusable control patterns and sheets: application conditions, limitations, and verification procedures.
• L4. Versioned, repeatable, and documented security and regression testing pack.
• L5. Contributions to solution and model evaluations: criteria, scenarios, results, limitations, and integration into the decision-making process.
• L6. Evidence file and decision sheet linking uses, versions, controls, results, and gaps.
• L7. Runbooks and operational security procedures, reviewed with recovery managers.
• L8. Tracking table and control adoption matrix, distinguishing applicability, deployment, and evidence.
• L9. Transfer file and prioritized remaining tasks, with returned assets and identified recovery managers.
• Mission Location: Paris
• Start Date: ASAP
• Remote Work: 2 days per week
• Required Seniority: 8 years minimum experience

Project details

• Start: flexible
• Remote: hybrid
• Location: Paris, France, FR
• Languages: French