Director, AI ML and Cloud Security

Senior Director, AI ML & Cloud Security

Why Us!

At GSK, we unite science, technology and talent to get ahead of disease together. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together. We’re proud to be leading a healthcare revolution, and we’re looking for people who can help us deliver on our ambition

Job Purpose:

Lead the function that designs, engineers and governs every AI and machine learning security capability GSK deploys. You own the agentic framework that is modernising security services across the Chief Security Office, the AI and ML platform, and the data fabric that that Cyber Architecture and Solutions designs and builds and a managed service vendor operates. You own the AI security standards that are binding on all GSK AI initiatives — not only those inside that Cyber Architecture and Solutions — and cloud security governance across the Azure and GCP estate. A 17-role function across the UK, India and the US, spanning AI architecture, AI engineering, AI platform and cloud security, business-facing AI advisory, and enterprise AI security authority.

About the team: AI ML and Cloud Security is the function through which GSK is transforming security itself. The team designs and builds the agentic framework, a multi-agent platform moving security services across the Chief Security Office from rule-based to AI-driven operation. It owns AI architecture and AI engineering end to end: the agent layer, LLM orchestration, the AI and ML platform, and the data fabric pipeline that CAS designs, builds and tests before a managed service vendor operates it. The team also governs AI tool security posture, advises on cloud security across the Azure and GCP estate, and is the front door between GSK's business units and R&D and the technical AI function. AI security standards set here are binding on every AI initiative in GSK. Seventeen roles across the UK, India and the US.

What makes this role different. This is not an AI governance role with an engineering team attached. You will be setting agent authorisation models and trust boundaries where no industry precedent exists and deciding whether an LLM-based control is reliable enough to depend on for a security outcome in a GxP environment where the consequence reaches medicine supply and clinical data. Your architects and engineers work in LangChain, LangGraph, vector databases and production Kubernetes, and they will expect you to follow the detail and challenge it. If your AI experience is policy frameworks, maturity models and vendor assessments, this role will not suit you and the interview will establish that quickly. Equally, if you have deep AI engineering but have never held a security line against a funded programme under delivery pressure, this will be a hard step.

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Set the three-year plan that moves CSO security services from rule-based to agent-operated, and defend the investment case for it to the CISO and GSK Tech leadership.
• Own the architecture, engineering and secure delivery of the agentic framework transforming security services across the Chief Security Office — agent authorisation models, tool-invocation control, human-in-the-loop gates, trust boundaries and runtime monitoring, designed in from inception.
• Own the design-to-build-to-handover pipeline: specifications engineered faithfully, the data fabric built and tested to specification, and vendor handover packages good enough for a managed service to operate safely from day one.
• Own the AI security standards, reference architectures and threat models binding across CAS and every GSK business AI initiative; no AI capability is architected, built or released without meeting them.
• Lead a 17-role function across five sub-functions and three countries, including leaders of teams, and own its capability and succession plan in a genuinely scarce skills market.
• Own AI platform security governance: agent risk-tiering, LLM and API exposure standards, AI-specific incident response, and the shadow AI discovery programme across the business.
• Own cloud security governance across Azure and GCP on an advisory and standards-setting basis, exercising authority through standards and escalation while platform teams retain remediation.
• Own adversarial AI defence: AI red teaming, prompt and model attack testing, and the mandatory remediation regime that follows, informed by MITRE ATLAS and current research.
• Translate the EU AI Act, NIST AI RMF and ISO/IEC 42001 into architectural requirements ahead of mandated deadlines rather than in response to audit.
• Represent the function to the CISO, GSK Tech leadership, the Enterprise AI programme, auditors and regulators, and own board-level escalation of material AI security risk.
• Own the commercial relationship with the managed service vendor operating the agentic framework and data fabric, including the service definition, the handover gates and the exit plan.

Why You!

• Significant leadership expereince in cyber security or AI engineering, including senior leadership in a regulated environment — domain focus: AI ML & Cloud Security (AI Architecture, AI Engineering, AI Platform & Cloud Security, AI Business Facing); setting the AI security strategy and roadmap with measurable outcomes
• Designing and delivering an agentic AI framework into production at enterprise scale — multi-agent orchestration, tool and action scoping, guardrails, containment and rollback, evaluation and regression testing of non-deterministic behaviour, observability, audit traceability and full agent lifecycle
• Leading a combined AI architecture and engineering organisation — design authority held separate from build — and governing build-to-operate transition of AI tools and the data fabric to a managed service vendor
• Enterprise AI/ML security — standards library, AI threat modelling, model and agent risk tiering, adversarial testing and shadow AI discovery — covering prompt injection, data poisoning, model extraction, excessive agency and AI supply-chain risk (MITRE ATLAS, OWASP LLM Top 10)
• Enterprise data fabric from classification architecture to built, tested pipeline, plus cloud security posture governance across Azure and GCP
• Track record leading leaders of teams across multiple geographies and time zones.
• Executive presence to operate as a technical peer to CISO, CTO and Enterprise AI leadership, and to say no credibly to funded initiatives.
• Senior security certification such as CISSP or CCSP, plus AI security or AI governance credentials
• Working command of NIST AI RMF, ISO/IEC 42001, with GxP and data integrity requirements applied to AI the EU AI Act and the OWASP Top 10 for LLM Applications, including where each stops being useful.
• LangChain or LlamaIndex orchestration, vector databases and retrieval tuning, production Python and Kubernetes
• Familiarity with MITRE ATLAS and published adversarial ML research.
• Hands-on familiarity with LLM orchestration, RAG patterns, vector databases and MLOps tooling.
• Certified Kubernetes Security Specialist, or equivalent demonstrable container security depth.
• Experience of GxP-regulated or other safety-critical environments where an automated action carries real-world consequence.
• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Enterprise AI programme and business partnering on use-case intake, feasibility and risk-based prioritisation
• Building and retaining scarce AI engineering and AI security capability, including scaling a technical team

Ready to apply?

Ready to lead the future of secure AI and cloud technology? Join GSK and help us make a real difference in improving health worldwide. Apply today. We look forward to hearing from you. (Please take a personal copy of the Job Description, as this will not be available online post closure of the advert)

Closing Date: 6th November 2026

Working Pattern

This role is based in the United Kingdom and offers a hybrid working model, with 2/3 days a week onsite at our central London HQ.

#GSKcso

#AGTech

AI for Cybersecurity, AI for Cybersecurity, Application Security, CI/CD, Cloud Security, Computer Programming, Data Security, Identity Access Management (IAM), Information Systems, Infrastructure Security, Kubernetes, LangChain (FrameWork), LangGraph, Large Language Models (LLMs), LlamaIndex, Machine Learning Operations, MITRE ATT&CK Framework, MLflow, ML Security, Open Web Application Security Project (OWASP), Operating Systems Security, OWASP Top 10, Python (Programming Language), Scripting, Security Engineering {+ 3 more}

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive.

We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

GSK is an Equal Opportunity Employer. This ensures that all qualified applicants will receive equal consideration for employment without regard to race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), parental status, national origin, age, disability, genetic information (including family medical history), military service or any basis prohibited under federal, state or local law.

We believe in an agile working culture for all our roles. If flexibility is important to you, we encourage you to explore with our hiring team what the opportunities are.

Should you require any adjustments to our process to assist you in demonstrating your strengths and capabilities contact us at UKRecruitment.Adjustments@gsk.com where you can also request a call.

Please note should your enquiry not relate to adjustments, we will not be able to support you through these channels. However, we have created a Recruitment FAQ guide. Click the Link where you will find answers to multiple questions we receive

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

Please note that if you are a US Licensed Healthcare Professional or Healthcare Professional as defined by the laws of the state issuing your license, GSK may be required to capture and report expenses GSK incurs, on your behalf, in the event you are afforded an interview for employment. This capture of applicable transfers of value is necessary to ensure GSK’s compliance to all federal and state US Transparency requirements. For more information, please visit the Centers for Medicare and Medicaid Services (CMS) website at https://openpaymentsdata.cms.gov/