• Define and maintain the governance framework for AI-enabled capabilities across the software and model lifecycle, including intake, design review, implementation controls, testing expectations, deployment review, and ongoing monitoring. • Establish technical control requirements for AI systems, including documentation standards, model and prompt inventories, traceability, approval paths, and change management expectations. • Ensure governance requirements are practical for engineering teams and embedded into delivery workflows where possible. • Operate the processes required to support internal and external compliance expectations for AI-enabled products and internal AI use cases. • Maintain evidence, decision records, inventories, risk assessments, and control mappings needed for audits, client diligence, investor diligence, and internal reviews. • Coordinate responses to AI-related diligence requests and partner with subject matter experts to ensure responses are accurate and supportable. • Partner with Security, Privacy, Legal, and Engineering to identify and manage risks related to model behavior, data handling, access patterns, third-party AI services, output quality, explainability, and system changes. • Build and run review paths for new AI use cases, material updates, and exceptions requiring elevated scrutiny. • Define escalation criteria, mitigation tracking, and approval workflows for higher-risk AI implementations. • Work directly with product and engineering teams to translate policy and control requirements into technical implementation guidance. • Help teams design compliant approaches for logging, testing, access control, human review, fallback behavior, documentation, and monitoring. • Influence architecture and delivery decisions so governance is built into systems rather than applied after the fact. • Maintain current inventories of AI systems, models, vendors, prompts, datasets, and related technical dependencies as required by company governance standards. • Ensure documentation is complete and usable across lifecycle stages, including design intent, data usage, review outcomes, testing artifacts, and operational controls. • Improve the tooling and process model for collecting, maintaining, and retrieving governance evidence. • Identify opportunities to automate governance activities within engineering and product workflows, including intake routing, policy checks, documentation capture, control verification, and evidence collection. • Partner with engineering teams to embed governance checks into existing delivery systems and lifecycle tooling. • Scale governance operations in a way that increases control coverage without creating unnecessary process overhead.

• Design and implement secure cloud architectures across public, private, and hybrid cloud environments (AWS, Azure, GCP). • Define cloud security standards, reference architectures, and security blueprints aligned with business objectives. • Assess cloud applications and infrastructure for security risks and recommend mitigation strategies. • Lead threat modeling, security architecture reviews, and risk assessments for cloud workloads. • Implement identity and access management (IAM), encryption, key management, and network security controls. • Ensure compliance with security frameworks and regulations such as ISO 27001, SOC 2, GDPR, HIPAA, and PCI-DSS. • Collaborate with DevOps, engineering, and infrastructure teams to integrate security into CI/CD pipelines (DevSecOps). • Evaluate and implement cloud-native and third-party security tools (CSPM, CASB, CWPP, SIEM, SOAR). • Provide security guidance for containerization, Kubernetes, and serverless architectures. • Mentor and guide security engineers and contribute to security awareness across teams. • Stay up to date with emerging cloud security threats, vulnerabilities, and best practices.

• Provide technical and disciplinary leadership for the IT Security team • Further develop the security strategy in close collaboration with application development and IT Operations • Ensure the integrity, confidentiality and stability of sensitive software and system landscapes • Identify vulnerabilities, develop sustainable remediation measures and oversee their implementation • Own security-related topics for in-house developments, system landscapes and interfaces • Advise management and prepare strategic decision-making materials • Build a modern, collaborative and forward-looking security culture

• Conduct a detailed security analysis of our Proxy server and its installation processes. • Investigate detection mechanisms employed by antivirus software (specifically at the signature, heuristic, and behavioral analysis levels). • Collaborate with antivirus vendors to provide necessary information and dispute false positives. • Develop and implement recommendations for changes to the Proxy server's code, build processes, and distribution methods to minimize the risk of false positives in the future. • Assess our product's adherence to best practices in application security. • Provide training to the development team on secure development practices, as needed.