AI Security Governance Architect

Are you passionate about helping organizations turn complex AI security challenges into clear strategies and practical solutions? At Plain Concepts, our AI Security Studios team helps organizations adopt AI securely and responsibly by defining how risks, controls and responsibilities should be managed throughout the AI lifecycle.

As an AI Security Governance Architect, you will help design and operationalize cybersecurity governance frameworks for AI, Generative AI and agentic AI, working closely with security, architecture and business teams. You will act as a cybersecurity subject matter expert for AI governance, translating emerging AI risks into practical security controls, requirements, processes and architecture patterns that organizations can actually implement.

Key Responsibilities

• Define and evolve AI security governance frameworks, covering AI use case registration, risk classification, security controls, approvals, exceptions, monitoring and periodic reassessment.
• Align AI security governance with recognized standards and regulations, including NIST AI RMF, NIST Generative AI Profile, ISO/IEC 42001, OWASP Top 10 for LLM Applications and the EU AI Act.
• Assess AI, GenAI and agentic AI use cases from a cybersecurity perspective, considering risks such as prompt injection, sensitive data leakage, identity and access management, excessive agent permissions, model exposure, third-party AI services, data residency and AI supply chain risks.
• Translate AI risks into practical security controls, including security policies, technical requirements, architecture patterns, guardrails, evidence requirements, ownership and acceptance criteria.
• Define security requirements and architecture patterns for different AI scenarios, including internal copilots, Microsoft 365 Copilot, custom GenAI applications, RAG systems, AI agents, ML models, vendor AI solutions and low-code/no-code AI automations.
• Integrate AI security governance with existing security tooling and processes, including solutions such as HiddenLayer, Sentra and Zenity, as well as GRC, IAM, DLP, SIEM/SOC, cloud security, CMDB and data governance environments.
• Define and improve AI security governance deliverables, including AI security control frameworks, use case classification models, security requirements, architecture patterns, risk acceptance processes, security review templates, KPI/KRI dashboards and maturity roadmaps.

Requirements

• 8+ years of experience in cybersecurity, with a strong background in security governance, security architecture, risk management, AppSec or Cloud Security.
• Strong understanding of AI and GenAI security risks, including LLM application security, prompt injection, sensitive data leakage, RAG security, AI agent permissions, model/API exposure, model supply chain and third-party AI services.
• Experience designing and operationalizing security governance and control frameworks, with the ability to turn policies and risk requirements into practical controls, processes and security requirements.
• Knowledge of AI security and governance frameworks, such as NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLM Applications and related AI risk and security standards.
• Ability to work across security, architecture and business teams, translating complex cybersecurity risks into clear requirements and recommendations for both technical and executive stakeholders.
• Excellent communication and documentation skills, with the ability to create executive-ready materials as well as detailed security and control documentation.
• Fluent in English and Spanish.

Nice to have

• Experience with AI governance programs, GenAI security assessments or AI Security Posture Management (AISPM).
• Experience securing enterprise AI environments such as Microsoft 365 Copilot, custom GenAI applications, RAG solutions or AI agents.
• Knowledge of cloud security architecture, Secure SDLC/DevSecOps, DSPM, GRC or AI-related SOC monitoring.
• Familiarity with tools such as HiddenLayer, Sentra, Zenity, Wiz, Microsoft Purview, Defender, CSPM/CWPP, DLP or SIEM/SOAR platforms.
• Knowledge of third-party AI risk management and security control evidence automation.
• Understanding of privacy and AI regulatory requirements, including GDPR, DPIAs, data classification and the EU AI Act.

Benefits

• Flexible schedule 35 Hours / Week 😎
• Fully remote work (optional) 🌍
• Flexible compensation (restaurant, transport, and childcare) ✌
• Fully free health insurance, with a co-payment for dental services 🚑
• Individual budget for training or equipment and free Microsoft certifications 📚
• English lessons 🗽
• Birthday day off 🌴🥳
• Monthly bonus for electricity and Internet expenses at home 💻
• Discount on gym plan and sports activities 🔝
• Plain Camp (annual team-building event) 🎪
• Extra perks: events attendance and speakers, welcome pack, baby basket, Christmas basket, discount portal for employees ➕ The pleasure of always working with the latest technological tools!

Will you let us know you better?

The selection process: Simple, just 3 steps.

• Phone screen
• 2 interviews with the team 🤘

What is Plain Concepts?

Plain Concepts is a global company of over 500 people passionate about technology and innovation. Since our founding, we have grown through technical proficiency and confidence in ideas that others might consider risky, creating custom solutions for our clients. With offices in more than 6 countries, our mission is to continue to drive cuttingedge projects around the world.

We are highly committed to technical excellence. We are known for developing highly customized projects, offering specialized technical consultancy and training.

Thanks to the great work of our technicians, we have been recognized for our ability to lead innovative projects that generate value, from artificial intelligence to blockchain, driving solutions that help companies optimize their performance.

What we do at Plain Concepts?

We pride ourselves on being a 100% technical team, dedicated to crafting custom projects from scratch, offering expert technical consultancy, and providing top-tier training.

Our approach goes beyond traditional outsourcing; we focus on creating value together with our clients.

Our teams are diverse and multidisciplinary, operating in a flat, collaborative structure.

We live and breathe AGILE principles, ensuring flexibility and efficiency in everything we do.

Knowledge-sharing is at our core: from supporting each other internally to contributing to the broader tech community through conferences, events, and talks.

Innovation drives us — even the boldest ideas are welcome here.

Transparency underpins all our relationships, fostering trust and long-term partnerships.

Want to learn more?

At Plain Concepts, we certainly seek to provide equal opportunities. We want diverse applicants regardless of race, colour, gender, religion, national origin, citizenship, disability, age, sexual orientation, or any other characteristic protected by law.