Platform AI Assurance Specialist in London

Job title & Salary

Job title: Platform AI Assurance Specialist Division: Operations Department: Cyber & Information Resilience (C&IR) Salary: National (Edinburgh and Leeds) ranging from £53,000 to £69,000 and London from £59,000 to £75,000 (salary offered will be based on skills and experience) This role is graded as: Senior Associate- Regulatory

Your external recruitment contact is Raimonda via Your internal recruitment contact is Pat via

About the FCA and team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services. Cyber and Information Resilience and the Operational Resilience departments have recently joined together to form a new directorate, Cyber & Operational Resilience (C&OR). The new directorate is focused on enabling secure and resilient regulation across the FCA and the PSR. There are a range of ways the directorate supports the organisation, below are links to each of the teams that make up C&OR. We are recruiting a Platform AI Assurance Specialist to join the Platform Assurance team within Cyber & Information Resilience. This role provides professional security assurance across AI capabilities deployed across the FCA technology estate, including cloud AI services, enterprise AI assistants, AI-assisted development tools, internally developed AI solutions, agentic systems, and AI-enabled SaaS (Software-as-a-Service) platforms. The role is suited to an experienced security professional with deep experience in cloud and platform security and the ability to assess AI-related risks and controls. You will independently review AI security architectures and controls, validate security findings and support proportionate, risk-based remediation decisions, while remaining independent from the ownership and implementation of assessed controls. You will help shape the FCA's AI assurance approach by developing assurance criteria, improving visibility of AI capabilities and embedding AI security assurance into existing platform assessment activities. While AI assurance will be the primary focus, you will work closely with specialists across AI testing, data security, privacy, architecture, procurement and governance where risks and controls span multiple disciplines.

Role responsibilities

• Act as the Platform AI Assurance SME, providing independent review and assurance over AI security architecture, control design, implementation and effectiveness across AI-enabled platforms, services and solutions
• Lead and deliver risk-based assurance reviews of cloud AI services, enterprise AI assistants, AI-assisted development tools, AI-enabled SaaS platforms, internally developed AI solutions and agentic systems
• Develop and maintain the FCA's AI assurance framework, including AI capability visibility, assurance criteria, control baselines and assessment methodologies aligned to FCA risk appetite
• Maintain assurance oversight of the FCA's AI landscape, including AI inventories and processes for identifying sanctioned, unauthorised, unmanaged or shadow AI
• Assess the effectiveness of controls across AI security domains including identity and access management, non-human identities, data protection, secure retrieval, model and data provenance, guardrails, monitoring, resilience, incident response and supply chain security
• Provide assurance over AI-specific risks, including prompt injection, sensitive data exposure, model and data poisoning, model extraction, excessive agency, tool misuse, insecure outputs and AI supply chain compromise
• Review AI security posture management, AI monitoring and control capabilities, validating findings through root-cause analysis and assessment of underlying control effectiveness
• Work closely with engineers, architects, platform owners, data specialists and security teams to agree pragmatic remediation, assess compensating controls and support risk-based decision making
• Embed AI security assurance into existing cloud, SaaS, endpoint, identity, network, configuration management and secure software delivery assurance activities

Skills required – Minimum

• Demonstrable experience assessing security controls and risks within cloud, SaaS and AI-enabled environments, with the ability to evaluate AI architectures, security risks and controls across areas such as models, APIs (Application Programming Interfaces), data flows, agents, identities and third-party services
• Demonstrated experience delivering independent, risk-based security assurance, including assessing architecture and control effectiveness, conducting reviews, testing controls, reporting findings and validating remediation activities
• Experience presenting technical security findings and recommendations to senior stakeholders, risk committees or governance forums

Skills required – Essential

• Understanding of AI and machine learning concepts, architectures and security risks, including generative AI, RAG, agentic systems, prompt injection, data exposure, model poisoning, model extraction and tool misuse
• Experience developing and applying security standards, control baselines and assurance criteria, including assessing policy compliance, guardrails, exceptions and compensating controls
• Knowledge of recognised security and AI frameworks, including NCSC (National Cyber Security Centre) guidance, NIST CSF (National Institute of Standards and Technology Cybersecurity Framework), NIST AI RMF (National Institute of Standards and Technology Artificial Intelligence Risk Management Framework), ISO/IEC 42001 (Artificial Intelligence Management Systems Standard), OWASP LLM (Open Worldwide Application Security Project) guidance, MITRE ATLAS (Adversarial Threat Landscape for Artificial Intelligence Systems) and CSA (Cloud Security Alliance) frameworks
• Experience assessing security posture and exposure management capabilities, such as CSPM (Cloud Security Posture Management), CNAPP (Cloud Native Application Protection Platform), SSPM (SaaS Security Posture Management), DSPM (Data Security Posture Management), AI-SPM (AI Security Posture Management), AI DLP (AI Data Loss Prevention), AI gateways and runtime guardrails
• Experience assuring AI-enabled services in cloud, SaaS or hybrid environments, including model APIs, AI agents, identity and access controls, sensitive data processing and cloud-native delivery

Benefits

• 25 days annual leave plus bank holidays
• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
• Private healthcare with Bupa, income protection and 24/7 Employee Assistance
• 35 hours of paid volunteering annually