Manager - AI & Application Security

To manage application and AI security across enterprise systems and AI-enabled solutions.

1 - Application & AI Security Governance:

·       Establish and maintain the Application Security and AI Security program.

·       Define security standards, control requirements, and governance processes for applications and AI-enabled solutions.

·       Align application and AI security practices with cybersecurity, privacy, data protection, enterprise architecture, and risk management requirements.

·       Maintain secure development guidelines for traditional applications, APIs, cloud-native applications, and AI solutions.

2 - Secure Design, Architecture Review & Threat Modeling:

·       Conduct threat modelling for business applications, APIs, cloud applications, AI use cases, and AI-enabled workflows.

·       Review application and AI solution architectures to identify security design weaknesses.
Assess authentication, authorization, session management, data flows, integration patterns, and trust boundaries.

·       Identify risks such as prompt injection, insecure AI integrations, model misuse, excessive agency, data leakage, and unauthorized access to sensitive information.

3 - Secure SDLC & DevSecOps Enablement:

·       Embed application and AI security requirements across design, development, testing, release, and production deployment stages.

·       Advise development teams on secure software engineering, secure coding, API security, secrets management, dependency management, and DevSecOps practices.

·       Define security gates before production deployment for applications and AI solutions.

Promote developer security awareness and practical secure coding practices.

4 - Application Security Testing & Vulnerability Management:

·       Manage and review findings from SAST, DAST, API security testing, software composition analysis, container scanning, and manual security reviews.

·       Prioritize vulnerabilities based on severity, exploitability, exposure, business criticality, and data sensitivity.

·       Coordinate remediation with development, infrastructure, application owners, and cybersecurity teams.

·       Track closure of security findings and validate remediation before release or production go-live.

5 - AI Security, Privacy & Data Protection Risk Assessment:

·       Assess AI use cases for cybersecurity, privacy, legal, regulatory, and data protection risks.
Review AI-related data flows, training data, input/output handling, access controls, logging, retention, and sensitive data exposure risks.

·       Evaluate third-party AI services, internal AI platforms, APIs, plugins, and AI integrations with enterprise systems from cybersecurity perspective 

·       Define controls for prompt injection, data leakage, model misuse, insecure outputs, unauthorized data access, and AI-assisted software vulnerabilities.

6 - Advisory, Monitoring & Continuous Improvement:

·       Monitor emerging application security and AI security threats, vulnerabilities, attack techniques, and industry best practices.

·       Provide expert advisory to development, infrastructure, cybersecurity, privacy, and business teams.

·       Support secure adoption of AI technologies across the organization while enabling innovation safely.

·       Report application and AI security posture, risks, remediation progress, and key metrics to management.

·       Continuously improve tools, processes, standards, and security review practices.

·       Communication skills

·       Risk based approach.

·       Experience with Secure SDLC.

·       Experience performing threat modelling.

·       Experience securing APIs.

·       Experience reviewing source code.

·       Exposure to AI/LLM technologies, either through implementation, governance, or security assessments.

·       Experience supporting DevSecOps environments.

·       Experience assessing application security risks in regulated environments is preferred

·       Certified Secure Software Lifecycle Professional (CSSLP) preferred 

·       GIAC Web Application Penetration Tester (GWAPT) preferred

·       CISSP preferred

·       Vendor AI security or AI governance certifications (Microsoft, AWS, google, or equivalent)

4+ years of relevant experience

Bachelor’s degree in computer science, Software Engineering, Cybersecurity, or related field.