Senior Principal - AI ML and Cloud Security

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: AI Architecture & Standards (AI security standards, AI threat modelling and model/agent risk tiering).

Own the AI security standards library and the architecture governance framework for Cyber Architecture and Solutions.Own the AI security standards library and the architecture governance framework for Cyber Architecture and Solutions. This role owns standards and governance rather than solution design, which sits with AI Architecture. You run the quality reviews that confirm what Engineering built matches what Architecture specified, own the architecture decision log, and maintain the AI threat model library. The standards you write are binding on AI initiatives well beyond Cyber Architecture and Solutions.

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• →Develop and maintain the AI security standards library and the architecture governance framework.

• →Run architecture quality reviews validating that Engineering builds match approved specifications.

• →Own the architecture decision log so design rationale stays traceable for audit and regulatory inspection.

• →Build and maintain the AI threat model library: prompt injection including indirect, training data poisoning, model extraction, adversarial input, agent privilege escalation.

• →Translate the EU AI Act, NIST AI RMF and ISO/IEC 42001 into practical architectural requirements rather than restating them.

• →Define the governance gates an AI capability must pass before build, release or vendor handover.

• →Hold office hours for the engineering teams and turn the three most-asked questions each quarter into new pattern guidance, so the same exception is not requested twice.

• →Support assurance, audit and regulatory evidence requests from the governance framework.

• →Re-baseline the standards library against each new OWASP Top 10 for LLM Applications revision, NIST AI RMF profile and EU AI Act implementing act within 60 days of publication.

• →Mentor colleagues on standards and governance practice.

• →Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK's ;Responsible AI, privacy and security requirements.

• →Own the standards roadmap — which standards are being written, revised or retired, and by when — so the library stays ahead of the build rather than behind it.

• 15+ years in cyber security in a regulated environment — domain focus: AI Architecture & Standards (AI security standards, AI threat modelling and model/agent risk tiering)

• Building and maintaining the enterprise AI security standards library, translating the EU AI Act, NIST AI RMF and ISO/IEC 42001 into practical, enforceable architectural requirements

• AI threat model library and risk-tiering methodology — direct and indirect prompt injection, training-data poisoning, model extraction, adversarial input and agent misuse — mapped to MITRE ATLAS and OWASP LLM Top 10

• Running AI architecture governance — reviews, conformance, exceptions and quality reviews validating engineering builds against approved specifications, with gates before build, release or vendor handover

• Owning the architecture decision log so AI design rationale is traceable for audit and regulatory inspection, with policy-as-code conformance checks where possible

• EU AI Act, NIST AI RMF and ISO/IEC 42001 working knowledge

• GxP and data integrity requirements applied to AI systems

• Evidencing AI governance to internal audit or regulators

• Rego and OPA or Azure Policy authoring, so conformance checks run in the pipeline rather than in a review meeting.

• AI red-teaming and adversarial testing methods used to validate standards
• Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.
• Typical tools and technologies: AI security standards authoring, AI threat modelling using MITRE ATLAS and STRIDE adapted for machine learning, model and agent risk tiering frameworks, EU AI Act, NIST AI RMF and ISO/IEC 42001, OWASP Top 10 for LLM Applications, architecture decision records and conformance review, GxP-compliant documentation and evidence management.

#AGTech

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at IN.recruitment-adjustments@gsk.com to discuss your needs.

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing askus@gsk.com, so that we can confirm to you if the job is genuine.