AI Security Architecture- VP
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We must not repeat job title as heading (the page already shows it). So we don't add a heading for the title.
We must not include Job ID/requisition numbers as headings; fold minor metadata into short
or drop it. So we can drop Job ID line.
We must not include cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to remove the Equal Opportunity Employer paragraph, the Job Application Disclosure, the CEO Statement, etc. Also remove "About State Street" maybe? It's substantive? It's about the company, maybe keep? The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. The "About State Street" is substantive about the company, but it's generic boilerplate? Might be considered boilerplate but it's about the company. The instruction says remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "About State Street" is not exactly those categories; it's company overview. Might be okay to keep. However we need to see if it's considered boilerplate. Usually job postings include a company description; it's substantive. I'd keep it.
We need to include sections only when posting has real, specific content. So we need to decide which sections to include based on content.
Let's extract content:
- Who We Are Looking For: This is a paragraph describing the role: "We are in Vice President, AI Security Architecture reporting directly to the Managing Director, AI Security and Data Protection. You will lead the design and oversight of secure architecture patterns, reference architectures, standards, and guardrails for artificial intelligence, machine learning, and generative AI solutions across the enterprise. You will partner with engineering, platform, product security, data, risk, and business teams to ensure AI capabilities are secure by design, responsibly implemented, and aligned with internal control and regulatory expectations."
That's substantive. Could be under a heading like "About the role" or "Who We Are Looking For". The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should map to those standard headings. The posting's sections may not exactly match but we can map: "Who We Are Looking For" could be "About the role". "Why this role is important to us" could be maybe part of About the role or separate? Could be "About the role" as well. But we need to avoid thin sections. Perhaps combine "Who We Are Looking For" and "Why this role is important to us" into an "About the role" section.
- What You Will Be Responsible For: This is a list of responsibilities. Should be under "Responsibilities" heading with - .
- What We Value: This is a list of skills/qualities. Could be under "Skills" or "Qualifications". The instruction list includes Skills, Qualifications. We have "What We Value" describing skills that will help you succeed. Could be under "Skills". We'll output as
Skills
with - .
- Education & Preferred Qualifications: This is education and qualifications. Could be under "Qualifications" heading.
- Additional Requirements: Additional requirements like coordinate across global teams, travel, hybrid work requirement, shift timings. Could be under "Requirements" or maybe separate "Additional Requirements". But we have a heading "Requirements" in the list. We'll use that.
- Work Requirement: Hybrid work requirement, shift timings. This could be under "Schedule" heading. The instruction includes Schedule as possible heading. So we can put hybrid work and shift timings under Schedule.
- Salary Range: Under "Pay" heading.
- Benefits: Under "Benefits" heading.
- About State Street: Could be under "About the company" but not in list. Could be omitted? The instruction list does not include About company. But we could keep as a
without heading? The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but says use those for section headings. It might be okay to add other headings if needed, but better to stick to those. However "About State Street" is substantive; we could include as a
without a heading, or under a generic heading like "About the company". But the instruction didn't list that as example; but we could still use
About State Street
. It didn't forbid other headings, just gave examples. Safer to include as About State Street
.
We must not include sections with filler like "commensurate with experience". We have salary range specific, benefits specific, schedule specific.
Now we need to remove boilerplate: Equal Opportunity Employer paragraph, Job Application Disclosure, maybe the "Read our CEO Statement" etc. Also remove "Discover more information on jobs at StateStreet.com/careers". Also remove "As an Equal Opportunity Employer..." paragraph. Also remove "Job ID: R-797784". Also remove "Additional language requirements: N/A." (we can drop that line). Also remove "Work Requirement Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements. Shift Timings: Standard business hours with flexibility to support global stakeholders and critical security, architecture, or regulatory needs." We'll keep that info under Schedule.
Now we need to format.
Let's draft:
About the role
We are seeking a Vice President, AI Security Architecture reporting directly to the Managing Director, AI Security and Data Protection. You will lead the design and oversight of secure architecture patterns, reference architectures, standards, and guardrails for artificial intelligence, machine learning, and generative AI solutions across the enterprise. You will partner with engineering, platform, product security, data, risk, and business teams to ensure AI capabilities are secure by design, responsibly implemented, and aligned with internal control and regulatory expectations. This role is critical to enabling secure AI adoption, protecting sensitive data, reducing emerging technology risk, and establishing scalable architecture practices that support innovation without compromising resilience, regulatory readiness, or client trust.
Responsibilities
- Lead the design and implementation of secure architecture patterns for AI, machine learning, and generative AI systems, including data pipelines, model access, APIs, agents, retrieval-augmented generation, and AI-enabled applications.
- Define and maintain enterprise AI security reference architectures, technical standards, guardrails, reusable patterns, and architecture decision criteria.
- Lead architecture and design reviews for AI initiatives, ensuring security, privacy, resilience, and control requirements are incorporated early in the solution lifecycle.
- Perform AI-focused threat modeling across models, data flows, platforms, integrations, and user interactions, addressing risks such as data leakage, prompt injection, insecure model access, supply chain vulnerabilities, model misuse, and excessive agency.
- Translate identified risks into practical security requirements, mitigation strategies, compensating controls, and risk-based architecture decisions.
- Partner with engineering, product security, platform, cloud, application, and data teams to embed AI security controls into software development, DevSecOps, model development, deployment, and monitoring workflows.
- Develop validation criteria and repeatable assurance patterns for AI platforms, pipelines, models, third-party services, and emerging capabilities.
- Provide architecture oversight for generative AI tools, internal AI services, developer productivity solutions, and business-led AI use cases.
- Ensure AI security designs align with internal policies and applicable external standards and regulatory expectations, including NIST, ISO, and FFIEC concepts.
- Support risk, audit, compliance, and incident management activities through clear documentation of architecture decisions, control designs, residual risks, and remediation actions.
- Communicate technical risks, architecture options, and recommendations clearly to engineering teams, business stakeholders, governance forums, and senior leadership.
- Mentor architects and security practitioners, promote internal knowledge sharing, and continuously improve AI security architecture practices as technologies and threats evolve.
Skills
- Deep technical expertise in security architecture, secure design, application security, cloud security, product security, data protection, and modern engineering practices.
- Practical understanding of AI and machine learning architectures, generative AI, model and data pipelines, APIs, cloud-native platforms, and AI security risk patterns.
- Ability to translate complex technical and emerging risks into clear architecture requirements, control designs, implementation patterns, and executive decisions.
- Experience leading architecture reviews, threat modeling, technical risk assessments, and secure-by-design programs in complex enterprise environments.
- Strong collaboration and influencing skills across Security, Engineering, Technology, Data, Risk, Compliance, Audit, and business teams.
- Execution-focused leadership with sound judgment, strong problem-solving skills, and a commitment to measurable risk reduction.
- Curiosity, adaptability, and continuous learning in a rapidly evolving AI security landscape.
Qualifications
- Degree required: Bachelor’s degree in Computer Science, Information Security, Engineering, or a related discipline; advanced degree preferred.
- Years of experience: 10+ years of progressive experience in cybersecurity, including significant experience in security architecture, application security, product security, cloud security, or security engineering.
- Certifications required or preferred: CISSP, CCSP, CSSLP, cloud security, architecture, or comparable industry certifications preferred.
- Knowledge of tools or technologies: Cloud-native architectures; AI and machine learning platforms; generative AI and large language model solutions; APIs; data pipelines; DevSecOps and CI/CD; threat modeling; security testing; identity and access management; data protection; logging, monitoring, and security automation.
- Additional qualifications: Experience securing enterprise-scale platforms and applications, working in regulated environments, establishing reusable architecture standards, and communicating technical risk to engineering and senior leadership audiences.
Requirements
- Ability to coordinate across global teams and time zones.
- Support high-priority architecture, risk, audit, and incident activities as needed.
- Manage sensitive information in accordance with company requirements.
- Travel may be required based on business needs.
Schedule
Hybrid work requirement: Hybrid, subject to company and location-specific requirements. Shift timings: Standard business hours with flexibility to support global stakeholders and critical security, architecture, or regulatory needs.
Pay
Salary range: HK$680,000 - HK$1,445,000 Annual.
Benefits
Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family
for prose. We must not repeat job title as heading (the page already shows it). So we don't add a heading for the title. We must not include Job ID/requisition numbers as headings; fold minor metadata into short
or drop it. So we can drop Job ID line. We must not include cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to remove the Equal Opportunity Employer paragraph, the Job Application Disclosure, the CEO Statement, etc. Also remove "About State Street" maybe? It's substantive? It's about the company, maybe keep? The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. The "About State Street" is substantive about the company, but it's generic boilerplate? Might be considered boilerplate but it's about the company. The instruction says remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "About State Street" is not exactly those categories; it's company overview. Might be okay to keep. However we need to see if it's considered boilerplate. Usually job postings include a company description; it's substantive. I'd keep it. We need to include sections only when posting has real, specific content. So we need to decide which sections to include based on content. Let's extract content: - Who We Are Looking For: This is a paragraph describing the role: "We are in Vice President, AI Security Architecture reporting directly to the Managing Director, AI Security and Data Protection. You will lead the design and oversight of secure architecture patterns, reference architectures, standards, and guardrails for artificial intelligence, machine learning, and generative AI solutions across the enterprise. You will partner with engineering, platform, product security, data, risk, and business teams to ensure AI capabilities are secure by design, responsibly implemented, and aligned with internal control and regulatory expectations." That's substantive. Could be under a heading like "About the role" or "Who We Are Looking For". The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should map to those standard headings. The posting's sections may not exactly match but we can map: "Who We Are Looking For" could be "About the role". "Why this role is important to us" could be maybe part of About the role or separate? Could be "About the role" as well. But we need to avoid thin sections. Perhaps combine "Who We Are Looking For" and "Why this role is important to us" into an "About the role" section.
- What You Will Be Responsible For: This is a list of responsibilities. Should be under "Responsibilities" heading with - .
- What We Value: This is a list of skills/qualities. Could be under "Skills" or "Qualifications". The instruction list includes Skills, Qualifications. We have "What We Value" describing skills that will help you succeed. Could be under "Skills". We'll output as
Skills
with - .
- Education & Preferred Qualifications: This is education and qualifications. Could be under "Qualifications" heading.
- Additional Requirements: Additional requirements like coordinate across global teams, travel, hybrid work requirement, shift timings. Could be under "Requirements" or maybe separate "Additional Requirements". But we have a heading "Requirements" in the list. We'll use that.
- Work Requirement: Hybrid work requirement, shift timings. This could be under "Schedule" heading. The instruction includes Schedule as possible heading. So we can put hybrid work and shift timings under Schedule.
- Salary Range: Under "Pay" heading.
- Benefits: Under "Benefits" heading.
- About State Street: Could be under "About the company" but not in list. Could be omitted? The instruction list does not include About company. But we could keep as a
without heading? The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but says use those for section headings. It might be okay to add other headings if needed, but better to stick to those. However "About State Street" is substantive; we could include as a
without a heading, or under a generic heading like "About the company". But the instruction didn't list that as example; but we could still use
About State Street
. It didn't forbid other headings, just gave examples. Safer to include as About State Street
.
We must not include sections with filler like "commensurate with experience". We have salary range specific, benefits specific, schedule specific.
Now we need to remove boilerplate: Equal Opportunity Employer paragraph, Job Application Disclosure, maybe the "Read our CEO Statement" etc. Also remove "Discover more information on jobs at StateStreet.com/careers". Also remove "As an Equal Opportunity Employer..." paragraph. Also remove "Job ID: R-797784". Also remove "Additional language requirements: N/A." (we can drop that line). Also remove "Work Requirement Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements. Shift Timings: Standard business hours with flexibility to support global stakeholders and critical security, architecture, or regulatory needs." We'll keep that info under Schedule.
Now we need to format.
Let's draft:
About the role
We are seeking a Vice President, AI Security Architecture reporting directly to the Managing Director, AI Security and Data Protection. You will lead the design and oversight of secure architecture patterns, reference architectures, standards, and guardrails for artificial intelligence, machine learning, and generative AI solutions across the enterprise. You will partner with engineering, platform, product security, data, risk, and business teams to ensure AI capabilities are secure by design, responsibly implemented, and aligned with internal control and regulatory expectations. This role is critical to enabling secure AI adoption, protecting sensitive data, reducing emerging technology risk, and establishing scalable architecture practices that support innovation without compromising resilience, regulatory readiness, or client trust.
Responsibilities
- Lead the design and implementation of secure architecture patterns for AI, machine learning, and generative AI systems, including data pipelines, model access, APIs, agents, retrieval-augmented generation, and AI-enabled applications.
- Define and maintain enterprise AI security reference architectures, technical standards, guardrails, reusable patterns, and architecture decision criteria.
- Lead architecture and design reviews for AI initiatives, ensuring security, privacy, resilience, and control requirements are incorporated early in the solution lifecycle.
- Perform AI-focused threat modeling across models, data flows, platforms, integrations, and user interactions, addressing risks such as data leakage, prompt injection, insecure model access, supply chain vulnerabilities, model misuse, and excessive agency.
- Translate identified risks into practical security requirements, mitigation strategies, compensating controls, and risk-based architecture decisions.
- Partner with engineering, product security, platform, cloud, application, and data teams to embed AI security controls into software development, DevSecOps, model development, deployment, and monitoring workflows.
- Develop validation criteria and repeatable assurance patterns for AI platforms, pipelines, models, third-party services, and emerging capabilities.
- Provide architecture oversight for generative AI tools, internal AI services, developer productivity solutions, and business-led AI use cases.
- Ensure AI security designs align with internal policies and applicable external standards and regulatory expectations, including NIST, ISO, and FFIEC concepts.
- Support risk, audit, compliance, and incident management activities through clear documentation of architecture decisions, control designs, residual risks, and remediation actions.
- Communicate technical risks, architecture options, and recommendations clearly to engineering teams, business stakeholders, governance forums, and senior leadership.
- Mentor architects and security practitioners, promote internal knowledge sharing, and continuously improve AI security architecture practices as technologies and threats evolve.
Skills
- Deep technical expertise in security architecture, secure design, application security, cloud security, product security, data protection, and modern engineering practices.
- Practical understanding of AI and machine learning architectures, generative AI, model and data pipelines, APIs, cloud-native platforms, and AI security risk patterns.
- Ability to translate complex technical and emerging risks into clear architecture requirements, control designs, implementation patterns, and executive decisions.
- Experience leading architecture reviews, threat modeling, technical risk assessments, and secure-by-design programs in complex enterprise environments.
- Strong collaboration and influencing skills across Security, Engineering, Technology, Data, Risk, Compliance, Audit, and business teams.
- Execution-focused leadership with sound judgment, strong problem-solving skills, and a commitment to measurable risk reduction.
- Curiosity, adaptability, and continuous learning in a rapidly evolving AI security landscape.
Qualifications
- Degree required: Bachelor’s degree in Computer Science, Information Security, Engineering, or a related discipline; advanced degree preferred.
- Years of experience: 10+ years of progressive experience in cybersecurity, including significant experience in security architecture, application security, product security, cloud security, or security engineering.
- Certifications required or preferred: CISSP, CCSP, CSSLP, cloud security, architecture, or comparable industry certifications preferred.
- Knowledge of tools or technologies: Cloud-native architectures; AI and machine learning platforms; generative AI and large language model solutions; APIs; data pipelines; DevSecOps and CI/CD; threat modeling; security testing; identity and access management; data protection; logging, monitoring, and security automation.
- Additional qualifications: Experience securing enterprise-scale platforms and applications, working in regulated environments, establishing reusable architecture standards, and communicating technical risk to engineering and senior leadership audiences.
Requirements
- Ability to coordinate across global teams and time zones.
- Support high-priority architecture, risk, audit, and incident activities as needed.
- Manage sensitive information in accordance with company requirements.
- Travel may be required based on business needs.
Schedule
Hybrid work requirement: Hybrid, subject to company and location-specific requirements. Shift timings: Standard business hours with flexibility to support global stakeholders and critical security, architecture, or regulatory needs.
Pay
Salary range: HK$680,000 - HK$1,445,000 Annual.
Benefits
Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family
Skills
with- .
- Education & Preferred Qualifications: This is education and qualifications. Could be under "Qualifications" heading.
- Additional Requirements: Additional requirements like coordinate across global teams, travel, hybrid work requirement, shift timings. Could be under "Requirements" or maybe separate "Additional Requirements". But we have a heading "Requirements" in the list. We'll use that.
- Work Requirement: Hybrid work requirement, shift timings. This could be under "Schedule" heading. The instruction includes Schedule as possible heading. So we can put hybrid work and shift timings under Schedule.
- Salary Range: Under "Pay" heading.
- Benefits: Under "Benefits" heading.
- About State Street: Could be under "About the company" but not in list. Could be omitted? The instruction list does not include About company. But we could keep as a
without heading? The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but says use those for section headings. It might be okay to add other headings if needed, but better to stick to those. However "About State Street" is substantive; we could include as a
without a heading, or under a generic heading like "About the company". But the instruction didn't list that as example; but we could still use
About State Street
. It didn't forbid other headings, just gave examples. Safer to include asAbout State Street
. We must not include sections with filler like "commensurate with experience". We have salary range specific, benefits specific, schedule specific. Now we need to remove boilerplate: Equal Opportunity Employer paragraph, Job Application Disclosure, maybe the "Read our CEO Statement" etc. Also remove "Discover more information on jobs at StateStreet.com/careers". Also remove "As an Equal Opportunity Employer..." paragraph. Also remove "Job ID: R-797784". Also remove "Additional language requirements: N/A." (we can drop that line). Also remove "Work Requirement Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements. Shift Timings: Standard business hours with flexibility to support global stakeholders and critical security, architecture, or regulatory needs." We'll keep that info under Schedule. Now we need to format. Let's draft:About the role
We are seeking a Vice President, AI Security Architecture reporting directly to the Managing Director, AI Security and Data Protection. You will lead the design and oversight of secure architecture patterns, reference architectures, standards, and guardrails for artificial intelligence, machine learning, and generative AI solutions across the enterprise. You will partner with engineering, platform, product security, data, risk, and business teams to ensure AI capabilities are secure by design, responsibly implemented, and aligned with internal control and regulatory expectations. This role is critical to enabling secure AI adoption, protecting sensitive data, reducing emerging technology risk, and establishing scalable architecture practices that support innovation without compromising resilience, regulatory readiness, or client trust.
Responsibilities
- Lead the design and implementation of secure architecture patterns for AI, machine learning, and generative AI systems, including data pipelines, model access, APIs, agents, retrieval-augmented generation, and AI-enabled applications.
- Define and maintain enterprise AI security reference architectures, technical standards, guardrails, reusable patterns, and architecture decision criteria.
- Lead architecture and design reviews for AI initiatives, ensuring security, privacy, resilience, and control requirements are incorporated early in the solution lifecycle.
- Perform AI-focused threat modeling across models, data flows, platforms, integrations, and user interactions, addressing risks such as data leakage, prompt injection, insecure model access, supply chain vulnerabilities, model misuse, and excessive agency.
- Translate identified risks into practical security requirements, mitigation strategies, compensating controls, and risk-based architecture decisions.
- Partner with engineering, product security, platform, cloud, application, and data teams to embed AI security controls into software development, DevSecOps, model development, deployment, and monitoring workflows.
- Develop validation criteria and repeatable assurance patterns for AI platforms, pipelines, models, third-party services, and emerging capabilities.
- Provide architecture oversight for generative AI tools, internal AI services, developer productivity solutions, and business-led AI use cases.
- Ensure AI security designs align with internal policies and applicable external standards and regulatory expectations, including NIST, ISO, and FFIEC concepts.
- Support risk, audit, compliance, and incident management activities through clear documentation of architecture decisions, control designs, residual risks, and remediation actions.
- Communicate technical risks, architecture options, and recommendations clearly to engineering teams, business stakeholders, governance forums, and senior leadership.
- Mentor architects and security practitioners, promote internal knowledge sharing, and continuously improve AI security architecture practices as technologies and threats evolve.
Skills
- Deep technical expertise in security architecture, secure design, application security, cloud security, product security, data protection, and modern engineering practices.
- Practical understanding of AI and machine learning architectures, generative AI, model and data pipelines, APIs, cloud-native platforms, and AI security risk patterns.
- Ability to translate complex technical and emerging risks into clear architecture requirements, control designs, implementation patterns, and executive decisions.
- Experience leading architecture reviews, threat modeling, technical risk assessments, and secure-by-design programs in complex enterprise environments.
- Strong collaboration and influencing skills across Security, Engineering, Technology, Data, Risk, Compliance, Audit, and business teams.
- Execution-focused leadership with sound judgment, strong problem-solving skills, and a commitment to measurable risk reduction.
- Curiosity, adaptability, and continuous learning in a rapidly evolving AI security landscape.
Qualifications
- Degree required: Bachelor’s degree in Computer Science, Information Security, Engineering, or a related discipline; advanced degree preferred.
- Years of experience: 10+ years of progressive experience in cybersecurity, including significant experience in security architecture, application security, product security, cloud security, or security engineering.
- Certifications required or preferred: CISSP, CCSP, CSSLP, cloud security, architecture, or comparable industry certifications preferred.
- Knowledge of tools or technologies: Cloud-native architectures; AI and machine learning platforms; generative AI and large language model solutions; APIs; data pipelines; DevSecOps and CI/CD; threat modeling; security testing; identity and access management; data protection; logging, monitoring, and security automation.
- Additional qualifications: Experience securing enterprise-scale platforms and applications, working in regulated environments, establishing reusable architecture standards, and communicating technical risk to engineering and senior leadership audiences.
Requirements
- Ability to coordinate across global teams and time zones.
- Support high-priority architecture, risk, audit, and incident activities as needed.
- Manage sensitive information in accordance with company requirements.
- Travel may be required based on business needs.
Schedule
Hybrid work requirement: Hybrid, subject to company and location-specific requirements. Shift timings: Standard business hours with flexibility to support global stakeholders and critical security, architecture, or regulatory needs.
Pay
Salary range: HK$680,000 - HK$1,445,000 Annual.
Benefits
Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family