AI Cyber Lead

Richemont•New York, NY

1d•Hybrid

About The Position

Richemont, a global leader in luxury goods, is seeking an AI Cyber Lead for its Cyber Security Incident Response Team (CSIRT) in New York, NY. This role reports to the Senior Manager of Incident Response and is responsible for driving the design, development, and operationalization of AI-driven security capabilities. The AI Cyber Lead will act as the primary technical and strategic expert, integrating AI solutions across various security platforms and processes, including Cortex XSIAM, to enhance detection, investigation, and incident response. This position requires close collaboration with other security teams to ensure AI innovations are secure, scalable, and aligned with enterprise security strategy, ultimately elevating the team's AI maturity in complex environments.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Artificial Intelligence/Machine Learning, Cyber Risk Strategy and Governance, or a related technical field (or equivalent practical experience).
Minimum 3–5 years of professional experience in technology or advanced engineering environments (preferably within cybersecurity, security operations, detection engineering, AI security, or AI/ML engineering in enterprise or regulated environments), with demonstrated hands-on work applying AI/ML and agentic workflows to security use cases such as SOC triage, enrichment, and secure AI adoption.
Strong practical expertise in agentic AI systems, large language models (LLMs), retrieval-augmented generation (RAG), multi-agent orchestration, tool-using agents, and related frameworks.
Familiarity with Claude (including Claude Code) or GPT series as LLMs.
Hands-on experience with modern security operations platforms and a strong curiosity and can-do/can-learn mentality, ideally leveraging Cortex XSIAM / Cortex XDR, SIEM, SOAR, XDR, or equivalent tools (such as Microsoft Sentinel, Defender XDR, Purview, and Entra ID), with application of AI features for detection, triage, enrichment, and automated response or the building of agents on these platforms.
Solid understanding of SOC workflows, incident response processes, threat detection, and security telemetry, combined with knowledge of AI-specific risks (prompt injection, excessive agency, data leakage, model abuse, authorization weaknesses) and mitigation strategies.
Proven track record of financial gains resulting in AI implementation on SOC processes.
Professional competencies: strong analytical and problem-solving skills, ability to translate complex technical risks, architectures, and capabilities into business priorities and actionable roadmaps for technical stakeholders, decision-makers, and C-suite leaders; collaborative mindset; and capacity to influence without formal authority as a senior individual contributor and team reference point.

Nice To Haves

Master’s degree preferred.
Experience securing, operationalizing, and governing such systems in production security environments is highly valued.
Familiarity with European and global regulatory frameworks (AI Act, NIS2, DORA, GDPR) and standards (ISO 27001, NIST, CIS) is a plus.
Experience bridging operational security teams (CSIRT/SOC) with broader security technology or platform groups.
Familiarity with Model Context Protocol (MCP) or similar agent tooling patterns.
Experience enabling secure, company-wide AI adoption and platform integration (identity, endpoints, cloud, data protection, SIEM, AI governance) in regulated environments.
Relevant certifications (e.g., related to cybersecurity, cloud, or AI security) are a plus but not mandatory.

Responsibilities

Serve as the main technical point of reference and subject-matter expert for all AI development efforts within the CSIRT, partnering with analysts and engineers on best practices for agentic AI, LLM integration, RAG pipelines, secure automation, and AI governance in security operations.
Lead the design, prototyping, and implementation of AI-powered enhancements spanning Cortex XSIAM (including AI SmartScoring, technique-based incident grouping, and SOAR playbooks) and other security platforms, focusing on automated incidents triage and enrichment, threat hunting, investigation assistance, and response orchestration to deliver measurable reductions in CSIRT KPIs (MTTx).
Architect and operationalize agentic AI systems and workflows that improve SOC efficiency, reduce mean time to detect and respond, and support complex incident response processes while embedding robust guardrails, human-in-the-loop controls, auditability, least-privilege principles, and secure-by-default patterns aligned with enterprise risk and regulatory requirements based on local markets (e.g. China, Korea).
Act as the primary liaison and technical bridge between the CSIRT and other teams (including Threat Hunting, Threat Intel, Red Team, Forensics, and Group Security Technology), translating operational needs into AI solutions, aligning roadmaps, and ensuring consistent, secure adoption of AI capabilities across platforms and processes.
Own the expertise to identify high-impact AI use cases, conduct threat modeling for AI systems (including prompt injection, tool-use risks, data exposure, autonomous agent behaviors, and identity/security posture risks), and drive continuous improvement of AI-enabled defenses.
Evaluate emerging market solutions, frameworks, and techniques in agentic AI for SOCs and incident response; pilot promising technologies; and contribute to the definition of secure-by-default patterns, reference architectures, and operational standards for AI in security, including alignment with relevant regulatory frameworks inside the company (AI council).
Support knowledge sharing, mentorship to SOC analysts, and documentation of agentic developments, safe prompt libraries, evaluation frameworks, and best practices to accelerate responsible AI adoption and elevate AI maturity across the team.
Generate periodic reports, metrics, and insights on AI capability maturity, performance, and risk posture as needed.
Be responsible for governing agents, models, and their interactions, ensuring auditability and alignment with enterprise security and compliance priorities.
Communicate to senior management, executives and C-suite levels at need.