Principal - Design Assurance & Product Management - Cryptography & PQC

Overview

Senior individual contributor owning the Design Assurance methodology library and performing specialist domain reviews in cryptography and post-quantum cryptography, and AI security.

What you'll do

• Own the Design Assurance methodology library: review templates, assessment scoring criteria, evidence requirements and finding classification.
• Run the annual methodology calibration by re-scoring a sample of closed reviews across reviewers and correcting criteria where scoring is inconsistent.
• Perform specialist domain reviews in cryptography and AI, where generalist review is not credible.
• Translate new or changed architecture standards into assessment criteria the practice can apply consistently.
• Develop assessment approaches for emerging technology types before they arrive in the review queue.
• Advise reviewers on how to apply the methodology in ambiguous cases.
• Convert published architecture standards into assessment criteria, and return ambiguity in a standard to its owning domain as a defect.
• Record findings clearly enough to be acted on without further interpretation.
• Escalate contested findings rather than negotiating them away.
• Mentor analysts on methodology and review practice.
• Use approved AI tools in day-to-day work, validating outputs and following GSK's Responsible AI, privacy and security requirements.
• Hold assurance evidence to GxP and data integrity expectations so the review record stands up to audit and regulatory inspection.
• Lead design assurance reviews for Cryptography and PQC, validating control implementations and migration outputs against architecture standards, including key management, HSM, PKI and TLS review and the post-quantum migration to CRYSTALS-Kyber and CRYSTALS-Dilithium.
• Lead design assurance reviews for AI Security, including prompt-injection defences, guardrails, model access, agent tool-calling scope and AI data protection, reviewing against MITRE ATLAS and the OWASP Top 10 for LLM Applications.
• Act as senior review lead for complex and cross-domain reviews, peer-reviewing analyst outputs and running in-life health checks on critical tools.

What you'll need

• 10+ years in cyber security, with a domain focus on Design Assurance for Cryptography and PQC and AI Security.
• Experience owning a DA methodology library and vendor assurance playbook, including templates, scoring, evidence requirements, finding classification, test scenarios and acceptance criteria, automated where possible.
• Bachelor's degree in a relevant discipline, or equivalent professional experience.

Nice to have

• Cryptography, key management and PQC migration knowledge.
• AI platform security controls and threat modelling.
• Assurance and control-assessment frameworks (ISO 27001 Annex A, NIST CSF and NIST SP 800-53) applied as review criteria rather than cited as background.
• Scripting or tooling to automate review evidence and template maintenance.
• Updating Design Assurance assessment criteria whenever architecture standards change.

Details

• Location: Bengaluru Luxor North Tower.