Associate Director - AI ML and Cloud Security - AI Agent Engineering

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: AI Agent Engineering (agent layer of the agentic framework); hands-on leadership of an agent engineering team (build, not design).

Job Purpose:

Own the agent layer of the agentic framework — the build, not the design. You run the agent development pipeline: LLM integration, prompt-to-action engineering, agent evaluation and testing, and the reusable agent components the rest of the function depends on. You build GenAI security use cases including alert triage automation and threat summarisation.

About the team. AI ML and Cloud Security is the function through which GSK is transforming security itself. The team designs and builds the agentic framework, a multi-agent platform moving security services across the Chief Security Office from rule-based to AI-driven operation. It owns AI architecture and AI engineering end to end: the agent layer, LLM orchestration, the AI and ML platform, and the data fabric pipeline that Cyber Architecture and Solutions designs, builds and tests before a managed service vendor operates it. The team also governs AI tool security posture, advises on cloud security across the Azure and GCP estate, and is the front door between GSK's business units and R&D and the technical AI function. AI security standards set here are binding on every AI initiative in GSK. Seventeen roles across the UK, India and the US.

What makes this role different. Deep build work in the agent layer, leading a small team while remaining hands-on. The hardest part is testing: agent output is non-deterministic and you will be expected to have a credible answer for how you evaluate it. You build to a specification set by AI Architecture and secure AI security sign-off before release — this is not a role where you set the technical direction. Proof-of-concept experience will not be enough; we are looking for agents that ran in production.

Key responsibilities:

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

Own the agent layer: agent development pipeline, LLM integration, prompt-to-action engineering and agent lifecycle.

Own agent evaluation and testing, including credible approaches to non-deterministic output.

Build GenAI security use cases such as alert triage automation and threat summarisation.

Develop reusable agent components that reduce effort on the next build.

Build to AI Architecture's specifications and raise design problems rather than engineering around them.

Apply the binding AI security standards to every agent — tool-invocation control, identity binding, least-privilege scoping — and secure sign-off before release.

Prepare agent workstream handover packages to the standard the managed service needs.

Hold AI Platform Engineering to the model-serving endpoints, vector index service levels and token budgets your agents depend on, and escalate when an agent outgrows them.

Lead the agent engineers building the agent layer, and keep at least a third of your own week on code.

Run the two-week shadow period where the vendor's operators work your agents under supervision, and hold the go-live gate until their runbook survives a deliberately injected failure.

Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK's Responsible AI, privacy and security requirements.

Mentor the agent engineers and set the engineering standard for the agent layer by example — code review, evaluation discipline and documentation quality.

Apply GxP and data integrity expectations to agents that touch validated systems or the records they produce.

Basic Qualifications:

15+ years in cyber security or AI engineering in a regulated environment — domain focus: AI Agent Engineering (agent layer of the agentic framework); hands-on leadership of an agent engineering team (build, not design)

Agent engineering depth — LLM integration, prompt-to-action engineering, multi-agent orchestration, tool and function calling, memory and state management, RAG retrieval, prompt and model version control and reusable agent components

Agent safety engineering — evaluation harnesses for non-deterministic behaviour, red-team testing, guardrails, human-in-the-loop checkpoints, containment and rollback

Building GenAI security use cases — alert triage automation, threat summarisation and automated investigation — from architecture specification to production, integrated cleanly with the AI platform layer

Applying binding AI security standards to every agent — tool-invocation control, identity binding and least-privilege scoping — and preparing handover packages for a managed service

Preferred Qualifications:

LangChain or LlamaIndex, vector databases, retrieval tuning and production Python

Agent observability, audit traceability and guardrails

AI red-teaming tools such as Garak or PyRIT

Agent frameworks such as LangGraph, AutoGen, Semantic Kernel or CrewAI

• •Prompt and agent evaluation tooling — LangSmith, Promptfoo or equivalent
• •Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.
• •Typical tools and technologies: LangChain, LangGraph and LlamaIndex, LLM integration with tool and function calling, prompt-to-action engineering, agent memory and state management, agent evaluation frameworks such as LangSmith, Ragas and DeepEval, guardrail and output filtering frameworks, vector databases and retrieval tuning, production Python and Kubernetes.

#AGTech

Skills

AI Agent Governance, AI for Cybersecurity, AI Governance, AI Security Governance, Application Security, Cloud Security, Computer Programming, Data Classification, Data Security, Identity Access Management (IAM), Information Systems, Infrastructure Security, ML Security, Model Risk, Operating Systems Security, Scripting, Security Engineering, Security Technologies, Security Testing, Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at IN.recruitment-adjustments@gsk.com to discuss your needs.