Job title: Platform AI Assurance Specialist
Division: Operations
Department: Cyber & Information Resilience (C&IR)
- Salary: National (Edinburgh and Leeds) ranging from £53,000 to £69,000 and London from £59,000 to £75,000 (salary offered will be based on skills and experience)
- This role is graded as: Senior Associate- Regulatory
- Applications must be submitted through our online portal. Applications sent via social media or email will not be accepted.
About the FCA and team
We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services.
Cyber and Information Resilience and the Operational Resilience departments have recently joined together to form a new directorate, Cyber & Operational Resilience (C&OR). The new directorate is focused on enabling secure and resilient regulation across the FCA and the PSR. There are a range of ways the directorate supports the organisation, below are links to each of the teams that make up C&OR.
We are recruiting a Platform AI Assurance Specialist to join the Platform Assurance team within Cyber & Information Resilience. This role provides professional security assurance across AI capabilities deployed across the FCA technology estate, including cloud AI services, enterprise AI assistants, AI-assisted development tools, internally developed AI solutions, agentic systems, and AI-enabled SaaS (Software-as-a-Service) platforms.
The role is suited to an experienced security professional with deep experience in cloud and platform security and the ability to assess AI-related risks and controls. You will independently review AI security architectures and controls, validate security findings and support proportionate, risk-based remediation decisions, while remaining independent from the ownership and implementation of assessed controls.
You will help shape the FCA's AI assurance approach by developing assurance criteria, improving visibility of AI capabilities and embedding AI security assurance into existing platform assurance activities. While AI assurance will be the primary focus, you will work closely with specialists across AI testing, data security, privacy, architecture, procurement and governance where risks and controls span multiple disciplines.
Role responsibilities
- Act as the Platform AI Assurance SME, providing independent review and assurance over AI security architecture, control design, implementation and effectiveness across AI-enabled platforms, services and solutions
- Lead and deliver risk-based assurance reviews of cloud AI services, enterprise AI assistants, AI-assisted development tools, AI-enabled SaaS platforms, internally developed AI solutions and agentic systems
- Develop and maintain the FCA's AI assurance framework, including AI capability visibility, assurance criteria, control baselines and assessment methodologies aligned to FCA risk appetite
- Maintain assurance oversight of the FCA's AI landscape, including AI inventories and processes for identifying sanctioned, unauthorised, unmanaged or shadow AI
- Assess the effectiveness of controls across AI security domains including identity and access management, non-human identities, data protection, secure retrieval, model and data provenance, guardrails, monitoring, resilience, incident response and supply chain security
- Provide assurance over AI-specific risks, including prompt injection, sensitive data exposure, model and data poisoning, model extraction, excessive agency, tool misuse, insecure outputs and AI supply chain compromise
- Review AI security posture management, AI monitoring and control capabilities, validating findings through root-cause analysis and assessment of underlying control effectiveness
- Work closely with engineers, architects, platform owners, data specialists and security teams to agree pragmatic remediation, assess compensating controls and support risk-based decision making
- Embed AI security assurance into existing cloud, SaaS, endpoint, identity, network, configuration management and secure software delivery assurance activities
Skills required
Minimum:
- Demonstrable experience assessing security controls and risks within cloud, SaaS and AI-enabled environments, with the ability to evaluate AI architectures, security risks and controls across areas such as models, APIs (Application Programming Interfaces), data flows, agents, identities and third-party services
- Demonstrated experience delivering independent, risk-based security assurance, including assessing architecture and control effectiveness, conducting reviews, testing controls, reporting findings and validating remediation activities
- Experience presenting technical security findings and recommendations to senior stakeholders, risk committees or governance forums
Essential:
- Understanding of AI and machine learning concepts, architectures and security risks, including generative AI, RAG, agentic systems, prompt injection, data exposure, model poisoning, model extraction and tool misuse
- Experience developing and applying security standards, control baselines and assurance criteria, including assessing policy compliance, guardrails, exceptions and compensating controls
- Knowledge of recognised security and AI frameworks, including NCSC (National Cyber Security Centre) guidance, NIST CSF (National Institute of Standards and Technology Cybersecurity Framework), NIST AI RMF (National Institute of Standards and Technology Artificial Intelligence Risk Management Framework), ISO/IEC 42001 (Artificial Intelligence Management Systems Standard), OWASP LLM (Open Worldwide Application Security Project) guidance, MITRE ATLAS (Adversarial Threat Landscape for Artificial Intelligence Systems) and CSA (Cloud Security Alliance) frameworks
- Experience assessing security posture and exposure management capabilities, such as CSPM (Cloud Security Posture Management), CNAPP (Cloud Native Application Protection Platform), SSPM (SaaS Security Posture Management), DSPM (Data Security Posture Management), AI-SPM (AI Security Posture Management), AI DLP (AI Data Loss Prevention), AI gateways and runtime guardrails
- Experience assuring AI-enabled services in cloud, SaaS or hybrid environments, including model APIs, AI agents, identity and access controls, sensitive data processing and cloud-native delivery
Benefits
- 25 days annual leave plus bank holidays
- Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
- Private healthcare with Bupa, income protection and 24/7 Employee Assistance
- 35 hours of paid volunteering annually
- Colleagues spend a minimum of 50% of their working time in the office each month (60% for Directors and Executive Directors) across our London, Leeds and Edinburgh offices.
- A flexible benefits scheme designed around your lifestyle
For a full list of our benefits and our recruitment process as a whole visit our benefits page.
Our values and culture
Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation and delivers better regulation.
If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.
We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable.
Disability confident: our hiring approach
We’re proud to be a Disability Confident Employer and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements.
Useful information and timelines
Timeline:
- Job advert closes: 17 November 2026 at 11:59pm
- CV Review/Shortlist: 19 November 2026
- Interviews: from 25 November 2026
- The process will consist of a screening call, a face-to-face interview, and an online interview. We expect the F2F interviews to take place in the week commencing 30 November.
- Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.
SC Clearance is required for this role (SC Guidance) - you will hold or will be required to obtain Security Check (SC) level vetting
