Director, AI ML and Cloud Security

Director, AI ML & Cloud Security

Why Us!

At GSK, we unite science, technology and talent to get ahead of disease together. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together. We’re proud to be leading a healthcare revolution, and we’re looking for people who can help us deliver on our ambition

Job Purpose:

Lead AI engineering delivery for Cyber Architecture and Solutions: the team that builds what AI Architecture designs and hands it to a vendor to operate. You own four workstreams — agentic framework build, AI solution engineering, AI platform infrastructure and the data fabric pipeline — across seven engineers. You are accountable for build quality, test coverage and vendor handover readiness. You do not define architecture.

About the team: AI ML and Cloud Security is the function through which GSK is transforming security itself. The team designs and builds the agentic framework, a multi-agent platform moving security services across the Chief Security Office from rule-based to AI-driven operation. It owns AI architecture and AI engineering end to end: the agent layer, LLM orchestration, the AI and ML platform, and the data fabric pipeline that CAS designs, builds and tests before a managed service vendor operates it. The team also governs AI tool security posture, advises on cloud security across the Azure and GCP estate, and is the front door between GSK's business units and R&D and the technical AI function. AI security standards set here are binding on every AI initiative in GSK. Seventeen roles across the UK, India and the US.

What makes this role different: This is hands-on engineering leadership, not delivery management. You will review code, argue about orchestration patterns, and decide whether a build is genuinely ready for a vendor to run at 3am. Your engineers work in LangChain, LlamaIndex, vector databases and production Python on Kubernetes; if you cannot read that work critically you will not carry the team. The architecture is set by someone else and you will sometimes disagree with it — challenge it properly, then build it well.

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Own AI engineering delivery across agentic framework build, AI solution engineering, platform infrastructure and the data fabric pipeline.
• Chair the fortnightly build review with the managed service vendor and sign or refuse the handover certificate for each agent and pipeline they take on.
• Build AI-powered security capability including GenAI alert triage, automated threat investigation and LLM-assisted analysis, and prove it works before it is trusted.
• Hold the four workstream leads to a single release train, and arbitrate when agent and platform priorities compete for the same engineer.
• Set the engineering standard the four workstreams build to — test coverage thresholds, evaluation harness pass rates and the definition of handover-ready — and audit against it at each release.
• Ensure every build is tested, documented and packaged to the standard a managed service needs to operate it without Cyber Architecture and Solutions present.
• Lead six engineers across India and the UK and manage dependencies across the agent, platform and delivery workstreams.
• Embed security controls by design to the binding AI security standards and secure sign-off before release.
• Act as the senior engineering voice in architecture reviews, challenging designs on buildability, testability and operability.

Why You!

• Significant experience in cyber security or AI engineering, including leading technical teams across geographies — domain focus: AI Engineering; leading an AI engineering team delivering production AI at enterprise scale
• Leading four engineering workstreams — agentic framework build with a vendor, AI solution engineering (GenAI alert triage, automated investigation, LLM-powered tooling), data fabric pipeline, and AI/ML platform engineering (Kubernetes, CI/CD, resilience)
• Engineering standards for AI delivery — evaluation harnesses, red-team and prompt-injection testing, model and prompt versioning, observability, and cost and latency budgets
• Applying binding AI security standards in build — tool-invocation control, identity binding, least privilege, guardrails, output filtering and full audit traceability
• Building to architecture specification and signing off vendor handover — built, tested, documented and operationally ready for a managed service — raising design problems back rather than engineering around them
• Azure security certification (AZ-500) or Google Professional Cloud Security Engineer.
• Working command of NIST AI RMF, ISO/IEC 42001, the EU AI Act and the OWASP Top 10 for LLM Applications, including where each stops being useful.
• Familiarity with MITRE ATLAS and published adversarial ML research.
• Hands-on grounding in LangChain or LlamaIndex, vector databases, production Python and Kubernetes
• Evaluation and testing of non-deterministic agent behaviour
• AI security controls — guardrails, tool-invocation control and least-privilege scoping
• Hands-on familiarity with MLOps / LLMOps practice — model registry, prompt management, evaluation and cost monitoring in production
• Coordinating engineering delivery with architecture and AI security owners without redefining design or policy.
• Certified Kubernetes Security Specialist, or equivalent demonstrable container security depth.
• Experience of GxP-regulated or other safety-critical environments where an automated action carries real-world consequence.
• CISSP or CCSP.
• Experience in pharmaceutical, life sciences or another highly regulated industry.

Ready to apply?

Ready to lead the future of secure AI and cloud technology? Join GSK and help us make a real difference in improving health worldwide. Apply today. We look forward to hearing from you. (Please take a personal copy of the Job Description, as this will not be available online post closure of the advert)

Closing Date: 6th November 2026

Working Pattern

This role is based in the United Kingdom and offers a hybrid working model, with 2/3 days a week onsite at our central London HQ.

#GSKcso

#AGTech

AI for Cybersecurity, AI for Cybersecurity, Application Security, CI/CD, Cloud Computing, Cloud Security, Computer Programming, Data Security, Google Cloud Platform (GCP), Identity Access Management (IAM), Information Systems, Infrastructure Security, Kubernetes, LangChain (FrameWork), LangGraph, Large Language Models (LLMs), LlamaIndex, Machine Learning Operations, Microsoft Azure, MITRE ATT&CK Framework, MLflow, ML Security, Operating Systems Security, OWASP Top 10, Pinecone (Vector Database) {+ 6 more}

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive.

We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

GSK is an Equal Opportunity Employer. This ensures that all qualified applicants will receive equal consideration for employment without regard to race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), parental status, national origin, age, disability, genetic information (including family medical history), military service or any basis prohibited under federal, state or local law.

We believe in an agile working culture for all our roles. If flexibility is important to you, we encourage you to explore with our hiring team what the opportunities are.

Should you require any adjustments to our process to assist you in demonstrating your strengths and capabilities contact us at UKRecruitment.Adjustments@gsk.com where you can also request a call.

Please note should your enquiry not relate to adjustments, we will not be able to support you through these channels. However, we have created a Recruitment FAQ guide. Click the Link where you will find answers to multiple questions we receive

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

Please note that if you are a US Licensed Healthcare Professional or Healthcare Professional as defined by the laws of the state issuing your license, GSK may be required to capture and report expenses GSK incurs, on your behalf, in the event you are afforded an interview for employment. This capture of applicable transfers of value is necessary to ensure GSK’s compliance to all federal and state US Transparency requirements. For more information, please visit the Centers for Medicare and Medicaid Services (CMS) website at https://openpaymentsdata.cms.gov/