Role Summary

The Director, AI Security will build and lead an India-based AI security engineering and enablement function responsible for protecting enterprise use of artificial intelligence: generative AI, copilots, agents, large language models, machine learning platforms, AI-enabled SaaS, and AI-integrated business workflows.

Reporting to the U.S.-based Senior Director, Data & AI Security, with a dotted line to the India-based Senior Director, Endpoint & Infrastructure Security, this role translates global AI security strategy into scalable engineering, control, and governance outcomes. It is both strategic and technical, and focused on securing AI adoption without blocking innovation while addressing data leakage, prompt injection, model misuse, insecure integrations, shadow AI, agentic workflow risk, and intellectual property exposure.

The role establishes India as a strategic global center of excellence for AI security engineering and operations, not only a delivery location.

Key Responsibilities

AI Security Strategy and Execution

Translate enterprise Data & AI Security strategy into India-based delivery plans, engineering roadmaps, and measurable objectives.

Lead design and execution of security controls across internally developed models, third-party AI services, SaaS AI features, copilots, retrieval-augmented generation, agentic workflows, and AI-enabled automation.

Establish practical AI security patterns that enable innovation while protecting sensitive data, regulated information, credentials, and IP.

AI Security Architecture and Engineering

Lead AI security architecture across enterprise AI platforms, cloud AI services, model integrations, data pipelines, and AI-enabled applications.

Create and maintain secure design patterns for generative AI platforms, LLM and model API integrations, RAG systems, vector databases and embeddings, AI agents and tool invocation, prompt and response handling, and human-in-the-loop controls.

Ensure designs address confidentiality, integrity, availability, identity, data protection, privacy, auditability, resilience, and abuse prevention.

AI Risk Management and Control Design

Define and operationalize controls for prompt injection (direct and indirect), sensitive data leakage, model manipulation and abuse, insecure plugin/tool/agent integrations, unauthorized access through RAG or connectors, excessive agency and unsafe automation, shadow AI, insecure model supply chain, and IP exposure.

Partner with risk, legal, privacy, and compliance to ensure AI controls are practical, enforceable, and measurable.

Partner with Data Security and Privacy on classification, minimization, residency, DLP, encryption and key management, entitlement review, retention, and training and RAG corpus governance — ensuring AI does not create uncontrolled copies, embeddings, or derived data stores outside enterprise governance.

Cross-Domain Control Integration

Work with the India-based Senior Director, Endpoint & Infrastructure Security to embed AI security requirements into endpoint, browser, infrastructure, collaboration, developer, and platform controls.

Drive integration across secure access to AI tools from managed and unmanaged endpoints, endpoint DLP, device posture and conditional access, developer workstation protections for AI-assisted coding, secrets protection, secure hosting of AI workloads, and AI telemetry.

Secure AI Adoption, Assurance, and Operations

Build practical enablement: AI security intake, risk tiering, assessment templates, control requirements, approved-tool guardrails, shadow AI discovery, production readiness checklists, and exception models.

Lead or enable AI security testing for prompt injection, RAG data leakage, authorization bypass, connector misuse, unsafe agent actions, excessive permissions, adversarial input, and AI-generated code risk — in partnership with application security, red team, and model risk.

Partner with cyber defense and the SOC to define AI telemetry, monitoring, and incident response playbooks covering AI tool usage, high-risk prompt and response patterns, sensitive data movement, connector and agent activity, and shadow AI indicators.

Team Leadership and India Capability Building

Build and lead an India-based AI security team spanning architecture, engineering, assurance, governance enablement, and technical program management.

Develop a leadership bench and technical career path across AI security architecture, cloud and platform security, application and API security, AI security testing, and automation.

Required Experience

12+ years in cybersecurity, application security, data security, cloud or infrastructure security, AI/ML security, or related technology risk disciplines.

5+ years leading technical cybersecurity or security engineering teams.

Strong understanding of generative AI, machine learning platforms, AI-enabled SaaS, APIs, data pipelines, cloud platforms, and enterprise application architectures.

Experience defining security controls for high-risk or emerging technology platforms.

Strong understanding of data protection, identity, endpoint, cloud, application, infrastructure, and cyber defense dependencies.

Demonstrated ability to translate emerging technology risk into practical architecture, engineering, and control outcomes.

Ability to lead across geographies, cultures, and time zones, with strong executive-level written and verbal communication.

Preferred Experience

Securing enterprise AI, generative AI, LLM, or AI-enabled SaaS platforms, including RAG, vector databases, AI agents, copilots, model APIs, AI gateways, or prompt security controls.

Healthcare, pharmaceutical services, financial services, or another highly regulated industry.

AI governance frameworks, model risk management, privacy engineering, or responsible AI programs.

OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, ISO 27001, NIST CSF, or HITRUST.

Cloud AI services across Azure, AWS, or GCP.

Building a new security capability or establishing India-based global security capabilities.

Key Partners

AI product and data science teams, enterprise architecture, application and data security, privacy, legal, risk and compliance, cloud/endpoint/infrastructure security, IAM, cyber defense, third-party risk, and business technology leaders.

.

Bachelor's degree in cybersecurity, information technology, computer science, engineering, or a related field, or equivalent experience required. Master's degree in cybersecurity, information technology, computer science, engineering, or a related field, or equivalent experience preferred. 10+ years of experience in security engineering, cybersecurity, information security, technology risk, or a related field required. 5+ years of experience in a management capacity required. Certification in cybersecurity, cloud security, risk preferred.

What Cencora offers

​Benefit offerings outside the US may vary by country and will be aligned to local market practice. The eligibility and effective date may differ for some benefits and for team members covered under collective bargaining agreements.

Full time

Affiliated Companies

Affiliated Companies: CENCORA BUSINESS SERVICES INDIA PRIVATE LIMITED

Equal Employment Opportunity

Cencora is committed to providing equal employment opportunity without regard to race, color, religion, sex, sexual orientation, gender identity, genetic information, national origin, age, disability, veteran status or membership in any other class protected by federal, state or local law.

The company’s continued success depends on the full and effective utilization of qualified individuals. Therefore, harassment is prohibited and all matters related to recruiting, training, compensation, benefits, promotions and transfers comply with equal opportunity principles and are non-discriminatory.

Cencora is committed to providing reasonable accommodations to individuals with disabilities during the employment process which are consistent with legal requirements. If you wish to request an accommodation while seeking employment, please call 888.692.2272 or email [email protected]. We will make accommodation determinations on a request-by-request basis. Messages and emails regarding anything other than accommodations requests will not be returned