New opportunity

Lead AI GRC- Cybersecurity- CFU - IT (Information Technology) - Bangalore, India

Societe Generale · Bangalore, India

About this role

Societe Generale is seeking a Lead AI GRC - Cybersecurity for their CFU team in Bangalore, India. This senior governance and advisory role acts as the primary cybersecurity partner for business stakeholders adopting artificial intelligence, ensuring that AI use cases and agents are assessed, challenged, and governed in line with internal security standards, regulatory expectations, and responsible AI principles.

Responsibilities

Identify, assess, and challenge cybersecurity risks associated with AI use cases, AI agents, and AI-enabled services.
Provide risk-based security guidance throughout the project lifecycle from ideation to production deployment.
Support security risk assessments, remediation planning, and acceptance decisions.
Review AI initiatives for alignment with internal security standards, governance frameworks, and responsible AI principles.
Assess risks related to data protection, model security, privacy, third-party AI providers, AI agents, and business process impact.
Ensure AI-related initiatives comply with applicable regulatory obligations, enterprise security policies, and risk management expectations.
Provide independent challenge where AI use cases create elevated security, privacy, operational, or misuse risks.
Monitor AI-related security risks, remediation actions, control gaps, and residual risk positions.
Report security posture, key risks, and mitigation progress to leadership and relevant governance bodies.
Support audits, regulatory reviews, risk committees, and internal assessments where required.
Track adherence to security requirements and challenge exceptions or deviations from expected controls.

Required qualifications

8+ years in cybersecurity, risk, governance, security advisory, or Information officer-related roles & AI.
Strong understanding of information security principles, control frameworks, cyber risk management, security architecture, and enterprise security governance.
Experience conducting security reviews, risk assessments, control validation, remediation tracking, and risk reporting.
Good understanding of AI, GenAI, AI agents, model security, data protection, privacy, third-party risk, prompt injection, misuse, and responsible AI considerations.
Ability to translate cybersecurity concerns into business-relevant risk language and pragmatic mitigation options.
Strong influencing, communication, and senior stakeholder engagement skills across business, technology, risk, compliance, and cybersecurity teams.
Understanding of security, privacy, compliance, and governance expectations applicable to AI.
Ability to operate effectively in complex, matrixed, and fast-evolving environments while balancing security, and operational constraints.

Preferred qualifications

Previous experience as an Information Officer, Information Security Officer, Cyber Risk Manager, Security Governance Lead, or Security Architect.
Knowledge of offensive security concepts, attacker behavior, threat actor methodologies, and adversarial AI risks.
Experience supporting AI governance, responsible AI, cloud security, data protection or risk programs.
Certifications such as CISSP, CISM, CRISC, ISO 27001, AZ-500, or equivalent practical experience.
Experience in regulated enterprise environments, including banking, financial services, technology, or critical infrastructure.

For full details about this role, click “Apply on company site” to view the employer’s original posting.

Skills for this role

CybersecurityRisk ManagementGovernanceArtificial IntelligenceGenerative AIAI AgentsInformation SecuritySecurity ArchitectureData ProtectionPrivacyThird-Party RiskPrompt InjectionStakeholder ManagementRegulatory ComplianceCloud SecurityCISSPCISMCRISCISO 27001AZ-500

Checking your profile…

Preparation suggestions, not the employer’s actual interview questions. Always check the original posting for current requirements.

Understand the role

What matters most

AI Risk Assessment and Security Guidance
Identify, assess, and challenge cybersecurity risks across AI use cases, AI agents, and AI-enabled services throughout their project lifecycle from ideation to production deployment, ensuring proper risk-based security guidance.
AI Governance and Responsible AI Oversight
Review AI initiatives to ensure alignment with internal security standards, governance frameworks, and responsible AI principles, covering data protection, model security, privacy, and third-party AI providers.
Stakeholder Engagement and Business Advisory
Bridge business, technology, cybersecurity, compliance, risk, and leadership teams by translating complex cybersecurity concerns into business-relevant risk language and pragmatic mitigation options.
Oversight, Reporting, and Regulatory Compliance
Monitor AI-related security risks, control gaps, and residual risk positions while reporting security posture to leadership and supporting audits, regulatory reviews, and risk committees.

Likely challenges to think through

Balancing Fast-Moving AI Innovation with Rigorous Governance
The challenge lies in providing constructive, independent challenge where AI use cases create elevated risks without becoming a bottleneck that slows down agile delivery teams. Prepare by developing frameworks for pragmatic risk acceptance and communicating mitigation options clearly to engineering leaders.
Managing Novel Adversarial AI and GenAI Threats
Assessing risks like prompt injection, model security vulnerabilities, and adversarial AI requires moving beyond traditional security control frameworks. Prepare by studying emerging AI threat taxonomies and offensive security concepts specific to large language models and autonomous agents.
Navigating Complex Matrixed Environments and Regulatory Expectations
Operating in a heavily regulated enterprise environment (such as banking and financial services) requires harmonizing multiple internal standards and external regulatory obligations. Prepare by reinforcing knowledge of enterprise governance frameworks, cloud security compliance, and cross-functional stakeholder management.

Practice your answers

Technical practice

How do you assess cybersecurity risks associated with autonomous AI agents?

What to coverDiscuss frameworks for evaluating autonomous behavior, tool-use permissions, and potential systemic risks or unintended actions. Explain how you analyze model security, autonomy boundaries, and business process impact during risk assessments.

What methodologies do you use to mitigate prompt injection and model security vulnerabilities in GenAI applications?

What to coverAddress techniques such as input sanitization, dual-LLM validation, system prompt hardening, and monitoring for adversarial manipulations. Emphasize how these controls protect enterprise deployments from data exfiltration and unauthorized command execution.

How do you provide risk-based security guidance throughout the AI project lifecycle?

What to coverExplain how you embed security reviews from ideation through production deployment. Discuss gating mechanisms, threat modeling for AI components, and collaborating with development teams to establish pragmatic remediation plans.

How do you evaluate third-party AI service providers for data protection and privacy risks?

What to coverDescribe your approach to reviewing external vendor architectures, data residency agreements, API security controls, and compliance with privacy regulations. Discuss how you ensure third-party integrations align with internal risk appetites.

How do you ensure AI initiatives comply with enterprise security policies and regulatory expectations?

What to coverDiscuss methods for mapping AI use cases against regulatory requirements, control frameworks, and internal governance policies. Explain how you track adherence, manage control gaps, and report residual risk positions to leadership.

What is your approach to providing independent challenge for high-risk AI use cases?

What to coverExplain how you constructively challenge business units when AI initiatives create elevated security, privacy, or misuse risks. Discuss how you balance rigorous governance and risk appetite without unnecessarily blocking innovation.

How do you integrate responsible AI principles into cybersecurity governance?

What to coverDiscuss the intersection of cybersecurity and responsible AI, including fairness, transparency, accountability, and privacy considerations. Explain how you review AI initiatives to ensure they meet ethical and regulatory standards.

How do you approach monitoring and reporting on AI-related security posture and control gaps?

What to coverDescribe the metrics, dashboards, and reporting mechanisms you use to communicate residual risks, remediation progress, and control gaps to governance bodies and risk committees.

How do you apply offensive security concepts to anticipate adversarial AI risks?

What to coverExplain how knowledge of threat actor methodologies, attacker behavior, and adversarial machine learning helps in anticipating bypasses, model extraction, and poisoning attacks. Discuss how you translate these concepts into defensive controls.

How do you design an effective operating model for AI governance in a complex, matrixed organization?

What to coverDiscuss strategies for collaborating across business, technology, compliance, risk, and legal teams to streamline AI adoption. Emphasize how you maintain operational efficiency while enforcing strict security standards.

Behavioural practice

Describe a time when you had to balance rigorous security requirements with fast-moving product innovation.

What to coverUse the STAR method to describe the situation, the competing priorities of speed versus risk mitigation, the specific actions you took to establish pragmatic security guidance, and the resulting business alignment.

Tell me about a situation where you had to challenge a business or technical stakeholder regarding an elevated security risk.

What to coverShare an example using the STAR method highlighting how you communicated complex risk language to senior stakeholders, handled resistance, and successfully implemented an independent challenge process without stalling the project.

Give an example of how you navigated conflicting expectations between compliance, legal, and engineering teams for a new technology rollout.

What to coverDescribe the context using the STAR method, how you engaged cross-functional teams, translated diverse regulatory requirements into actionable guidance, and reached a consensus on acceptable risk posture.

Describe a time when you identified a critical control gap in an emerging technology deployment.

What to coverDetail the situation using the STAR method, how you conducted the risk assessment, the remediation planning steps you introduced, and how you tracked the residual risk position to closure with leadership.

Sharpen your knowledge

Topics to prepare

Enterprise AI Governance and Responsible AI Frameworks
Exercise: Review internal governance frameworks and responsible AI principles (such as data protection, model security, privacy, and fairness) to evaluate how AI use cases and agents align with corporate risk appetite. Relevance: Directly addresses the core responsibility of reviewing AI initiatives for alignment with internal security standards and regulatory expectations.
Cybersecurity Risk Management and Control Frameworks
Exercise: Practice conducting risk assessments, control validation, and remediation planning across the project lifecycle from ideation to production deployment. Relevance: Aligned with the requirement for a strong understanding of information security principles, control frameworks, and cyber risk management.
Adversarial AI Threats and Model Security
Exercise: Study offensive security concepts, attacker behavior, and specific vulnerabilities like prompt injection, data poisoning, and model misuse. Relevance: Corresponds to the required understanding of AI risk, GenAI considerations, and adversarial AI vulnerabilities mentioned in the posting.

Skills to revise

Business Security Advisory and Risk Translation
Exercise: Practice translating complex technical cybersecurity findings and AI risks into business-relevant risk language and pragmatic mitigation options for senior stakeholders. Relevance: Essential for operating as a senior cybersecurity advisor who must bridge business priorities and security controls without blocking innovation unnecessarily.

Your preparation checklist

Prepare an AI Governance and Risk Assessment Portfolio
Compile examples of past security reviews, risk assessment reports, and control validation frameworks applied to AI initiatives or enterprise systems to demonstrate your capability in governing emerging tech.
Draft an AI Project Lifecycle Security Guidance Framework
Develop a structured template showing how you provide risk-based security guidance from ideation through production deployment, specifically addressing AI agents and data protection.
Formulate a Stakeholder Communication and Advisory Strategy
Prepare talking points or case studies illustrating how you translate complex technical cyber risks (such as prompt injection and model security) into business-relevant risk language for senior executives.
Review Regulatory Compliance and Security Control Standards
Refresh your knowledge of information security principles, control frameworks, and compliance expectations applicable to AI in regulated environments like banking and financial services.
Prepare Thoughtful Questions for the Interviewer
Draft targeted questions regarding how the CFU team balances fast-moving AI delivery with internal risk appetite, and how independent challenges are integrated into project workflows.

Availability last checked: 4 Nov 2026. Status can change after a check; confirm on the employer’s website. Report an issue · Our checking policy

KEEP EXPLORING

Similar AI jobs

Related skills and specializations in India. Matched to this role, not your profile.

Explore more jobs

Finding similar opportunities…