AI and Data SME

Department: Data Security (DSEC) / Cybersecurity Engagement: Contract Location: TBC Reporting To: Data Security Leadership / Cybersecurity

Role Overview

We are seeking an experienced AI & Data Security Consultant to play a pivotal role in shaping how Artificial Intelligence, particularly Agentic AI, is adopted, governed and secured within a complex enterprise environment.

Sitting within the Data Security (DSEC) function, this role will act as a critical bridge between the CTO organisation, emerging AI capabilities and the security teams responsible for protecting enterprise data.

The successful consultant will assess how AI can enhance existing Data Security capabilities, while also identifying the new risks, vulnerabilities and control requirements introduced by AI adoption.

This is a strategic and delivery-focused position, requiring someone who can translate emerging AI technologies into practical business use cases, assess their impact on existing security controls and take business ownership of agreed outcomes through to production.

Initially focused on AI capability mapping, Agentic AI and security controls, the role will progressively expand across the wider Data Protection landscape, including Data Security Controls, Encryption, Database Activity Monitoring and associated security capabilities.

Key Responsibilities

AI Strategy & Capability Mapping

Assess how AI and Agentic AI technologies can be applied within the Data Security function to improve operational effectiveness, automation, risk identification and control assurance.

Develop an AI capability map identifying relevant technologies, implementation patterns, opportunities and priority use cases across DSEC.Evaluate how AI could transform existing Data Security activities, processes and operating models.

Identify opportunities to introduce AI-driven automation and intelligent decision support across security controls.

Establish a clear understanding of the potential benefits, dependencies and risks associated with AI adoption.

CTO Engagement & Agentic AI Alignment

Work closely with the CTO organisation to understand the enterprise's emerging AI and Agentic AI strategy, architecture and delivery roadmap.

Review proposed AI capabilities and assess their implications for Data Security teams, processes and existing technology platforms.

Translate CTO-led AI initiatives into actionable requirements and outcomes for DSEC.

Identify gaps between proposed AI solutions and existing security capabilities, governance arrangements and operational controls.

Act as the primary DSEC representative in relevant AI strategy, design and implementation discussions.

AI Security Governance & Control Frameworks

Define the security controls required to support the safe and responsible adoption of AI technologies.

Assess risks associated with AI agents accessing, processing, sharing or acting upon sensitive enterprise data.

Establish appropriate control requirements covering data access, identity, permissions, encryption, monitoring, auditability and information protection.

Consider risks such as data leakage, prompt injection, unauthorised agent actions, excessive permissions and uncontrolled data movement.

Develop practical security patterns and guardrails for AI and Agentic AI implementations.

Ensure proposed controls align with enterprise security policies, regulatory requirements and established risk management frameworks.

Business Ownership & Production Delivery

Take business ownership of agreed AI-enabled Data Security capabilities, from initial assessment and definition through to production implementation.

Define business requirements, expected outcomes, acceptance criteria and operational readiness requirements.

Work with technology delivery teams, security architects, engineering teams and control owners to implement agreed solutions.

Ensure new capabilities are appropriately tested, governed, monitored and supported before production deployment.

Establish measurable success criteria to demonstrate operational benefits, control effectiveness and risk reduction.

Support the transition of new capabilities into business-as-usual operations.

Broader Data Protection & Security Controls

As the engagement evolves, the consultant will contribute to the wider Data Security control environment, including:

Data Security Controls: Understanding and improving controls governing sensitive information throughout its lifecycle.

Data Encryption: Assessing how encryption, cryptographic controls and key management protect enterprise information, including within AI-enabled workflows.

Database Activity Monitoring (DAM): Reviewing monitoring capabilities and identifying opportunities for AI-enhanced detection, analysis and response.

Data Access Governance: Assessing how AI agents and automated processes access and interact with protected data.

Control Integration: Identifying opportunities to align and standardise security controls across multiple Data Protection disciplines.

The longer-term ambition is to develop a more integrated approach to AI adoption and security across the full Data Protection control landscape.

Essential Experience & Skills

Strong background in Data Security, Data Protection, Cybersecurity or Security Controls, ideally gained within a large, complex and highly regulated enterprise.

Good understanding of AI technologies, Generative AI and emerging Agentic AI capabilities, including their implications for enterprise security.

Experience evaluating technology capabilities, developing use cases and translating strategic objectives into practical implementation plans.

Understanding of Data Security controls, data access governance, encryption and data monitoring technologies.

Experience developing, assessing or implementing security control frameworks.

Ability to engage confidently with CTOs, senior technology leaders, security architects and operational security teams.

Proven ability to take ownership of technology or security initiatives and drive outcomes through to production.

Strong stakeholder management, communication, analytical and problem-solving skills.

Ability to operate at both strategic and practical levels, balancing innovation with security, governance and operational requirements.

Desirable Experience

Experience within banking, financial services or another highly regulated industry.

Exposure to Agentic AI architectures, autonomous agents, AI orchestration or enterprise AI platforms.

Knowledge of Data Loss Prevention (DLP), Database Activity Monitoring (DAM), encryption, key management and data classification.

Familiarity with AI security risks and governance frameworks, including NIST AI RMF, ISO 27001 and OWASP guidance for LLM and Agentic AI applications.

Experience working across multiple cybersecurity control domains.

Previous involvement in AI-enabled security transformation, control automation or enterprise AI adoption programmes.