Principal Architect - AI

Staples India Business Innovation Hub Private Limited | Permanent\n\nDefine the enterprise AI security architecture & baselines across Azure, GCP, Data-bricks, on‑prem, third-party vendors, and Microsoft 365 Copilot — covering identity, access, data protection, runtime controls, observability, and incident response for internal agentic workflows and customer‑facing agentic commerce flows.\n\nEstablish agent identity & access guardrails with Microsoft Entra Agent ID/Agent Registry, Conditional Access policies, and least‑privilege patterns for both human and machine identities tied to AI agents (including Copilot Studio and the Microsoft 365 Agents SDK).\n\nHarden model runtime and tool‑calling using LLM firewalls, prompt injection defenses, content safety, jailbreak protection, and transaction controls —aligning GCP Model Armor and Azure Prompt Shields/Content Safety with security telemetry and response playbooks.\n\nGovern agents of all types, including agent registration, environment segregation, pipelines, sharing policies, DLP integration, and lifecycle controls for maker/owner changes and “owner less” agents.\n\nSecure Data-bricks AI/Mosaic workloads (model endpoints, gateways, Foundry integrations), standardizing authN/authZ, network isolation, secrets handling, and logging across notebooks, jobs, and serving layers.\n\nOperationalize SOC coverage for AI, integrating signals into SIEM systems, tuning detections for agent misuse, and using AI agents to accelerate triage, investigations, and incident response.\n\nEmbed privacy, compliance, and disclosure (DLP tools, sensitive data policies) into AI pipelines.\n\nArchitect cross‑team delivery — create reusable patterns, standards, and reference implementations; lead design reviews; coach engineering teams; and drive adoption via roadmaps and enablement.\n\nRequirements\n\nBasic Qualifications\n\nProficient in cybersecurity frameworks and standards.\n\nExperienced with cloud security, identity management, threat modeling, and incident response.\n\nExperience : 5+ years in security architecture; 3–5+ years designing controls for cloud platforms; hands‑on with AI/ML security or production LLM workloads.\n\nDepth in identity & access : Conditional Access, workload identities, service principals, managed identities, and agent identity governance patterns.\n\nCross‑cloud fluency especially with AI PaaS services : Azure, GCP, Data-bricks Mosaic, and Microsoft 365 Copilot/Copilot Studio.\n\nThreat‑driven mindset : Familiar with LLM‑specific risks (prompt injection, data exfiltration, model‑assisted fraud, tool‑calling abuse), secure SDLC for agents, working knowledge of all security control types, and red/blue team techniques adapted to AI.\n\nControls & observability : DLP, logging/telemetry, SIEM/SOAR integrations, Zscaler/Defender stack, and incident response playbooks tailored for agentic workflows.\n\nLeadership & communication : Proven ability to lead architecture programs, influence cross‑functional stakeholders, write clear standards, and mentor engineers.\n\nHow you’ll measure success\n\nGuardrail coverage : Measurable adoption of baseline controls and policies across all AI platforms and environments.\n\nReduced risk : Fewer high‑severity findings in AI threat modeling, pen tests, and control assessments\n\nOperational readiness : SOC detections and runbooks for AI threats in place; effective use of SIEM AI tools; audit‑ready evidence trails.\n\nGovernance maturity : AI Governance tools functioning at scale with clear owner/lifecycle controls.\n\nDeveloper enablement : Adoption of secure patterns and reference architectures by product teams; streamlined approvals that balance agility and control.\n\nPreferred Qualifications\n\n- Recognized cybersecurity certification (e.g., CISSP, CISM, CCSP, GIAC).\n- Cloud security certifications (Azure/GCP)\n- Familiarity with state‑level AI legislation, FTC guidance, and other international AI legislation\n\n#J-18808-Ljbffr