Role purpose
As our Senior AI Assurance Lead, you will play a key role in helping Access adopt and use AI responsibly. You will coordinate practical, risk-based assurance for AI systems used across our products, software development, business processes and standalone tools. Using agreed processes and assurance tooling, you will assess new or materially changed AI use cases, coordinate proportionate testing and monitoring, and provide clear evidence of risk and control effectiveness.
You will work closely with system owners and specialists across Cyber, Product and Engineering, IT&O, Third-Party Risk Management and In-House Legal. You will not be expected to own every technical control, investigation or governance decision. Instead, you will bring the right people together, maintain a reliable assurance record and ensure material concerns are escalated through established routes.
This is an opportunity to help build a sustainable programme of continuous AI assurance, prioritised by risk and supported by automation wherever practical. You will help identify material changes in systems, models, data, integrations, usage and external threats, then coordinate reassessment or control action where needed.
This is an assurance role, rather than a policy ownership or dedicated security operations position. In-House Legal retains responsibility for the overarching AI governance framework and legal interpretation, while technical and operational teams remain responsible for designing, operating and remediating their controls. You will provide the coordination, challenge and insight that help those teams make well-informed decisions.
What you'll be doing
1. AI discovery, inventory and intake
•Coordinate the intake of new or materially changed AI systems and confirm that each has a clear business owner, technical contact and accountable risk owner.
•Work with Product, Engineering, IT and business teams to understand the purpose, intended use and key dependencies of each system.
•Maintain accurate records in the AI inventory or assurance platform, following up gaps and unregistered use through agreed routes.
•Define the minimum information and evidence needed for proportionate assessment, drawing on subject matter experts where required.
2. Initial AI risk assessment
•Lead proportionate initial assessments for new or materially changed AI systems using the agreed methodology and tooling.
•Assess the use case, data, model, architecture, integrations, users and operational context, bringing in privacy, security, legal or technical specialists where needed.
•Document the initial risk profile, evidence gaps, required controls, monitoring needs and any residual risk decisions.
•Escalate higher-risk or novel cases to the appropriate governance, legal, security or risk authority rather than attempting to resolve them alone.
3. Continuous AI risk monitoring
•Place approved systems into a proportionate monitoring cycle based on risk and criticality.
•Configure and maintain practical monitoring rules, thresholds and reporting within the selected assurance tooling, using automation to reduce manual effort.
•Review material alerts and changes to models, data, prompts, agents, integrations, permissions or usage, and coordinate reassessment where warranted.
•Maintain an auditable assurance history and track material findings, exceptions and agreed actions with the teams responsible for remediation.
4. AI security testing and control assurance
•Plan and coordinate proportionate assurance testing, performing defined checks directly and engaging specialist teams for deeper technical testing.
•Assess relevant AI security risks, including prompt injection, information disclosure, insecure integrations, unsafe tool use, excessive agency and inappropriate access.
•Review evidence that agreed guardrails, access controls, logging, human oversight, data protections and fail-safe arrangements operate as intended.
•Help develop reusable test procedures for common AI services and architectures, improving consistency and reducing duplicated effort.
5. AI threat intelligence and horizon monitoring
•Maintain a focused view of authoritative AI threat, vulnerability and control guidance relevant to systems used by Access.
•Work with CSOC, Product Security and other specialists to assess material issues and translate them into targeted assurance checks or reassessment activity.
•Support AI-related incident and control-failure reviews by providing assurance records and ensuring agreed lessons are reflected in future assessments and monitoring.
6. Risk reporting and escalation
•Produce concise, risk-based reporting on systems in scope, material changes, emerging concerns and outstanding assurance findings.
•Highlight systems operating outside agreed controls, risk tolerance or monitoring requirements and escalate material issues through established Cyber, product, legal or enterprise risk routes.
•Provide practical assurance insight to governance forums and system owners, without duplicating the reporting owned by Cyber Risk or other teams.
What you'll bring
Essential skills and experience
•Practical understanding of generative AI, large language models, machine learning services or AI-enabled applications, with the ability to learn new technologies quickly.
•Experience in technology, cyber, product, operational risk or assurance, including assessing evidence and documenting proportionate findings.
•Experience using risk, security, observability, assurance or monitoring tools and interpreting their outputs.
•Awareness of common AI security and control risks, such as prompt injection, data leakage, unsafe tool use and excessive agency.
•Strong analytical judgement, with the ability to distinguish material risk indicators from noise and recognise when specialist input is needed.
•Able to produce clear, accurate documentation and concise updates in written and spoken English, including explaining technical findings to non-technical stakeholders and maintaining reliable assurance records.
•A collaborative, pragmatic approach that balances innovation, delivery and proportionate risk management.
Desirable skills and experience
•Experience with AI security testing, model evaluation, AI observability, security analytics or continuous-control monitoring.
•Familiarity with ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF, OWASP guidance or other recognised AI and security frameworks.
•Experience in a software product, SaaS or cloud technology environment.
•Awareness of privacy, data protection, model supply-chain and third-party AI risks.
•Experience producing risk dashboards or management reporting.
•Relevant professional training or qualifications in cybersecurity, risk, data, AI, software engineering or a related discipline.
The qualities that will help you succeed
•Analytical, curious and evidence-led.
•Collaborative and able to build credibility across technical, risk and governance teams.
•Comfortable challenging incomplete evidence while remaining constructive and practical.
•Clear and concise when reporting risk, decisions and limitations.
•Able to take ownership of coordination and follow-through without taking on the responsibilities of every contributing team.
•Comfortable working in an evolving area and improving processes over time.
About The Access Group
The Access Group is one of the largest UK-headquartered business management software providers. It provides solutions that empower more than 160,000 small and mid-sized organisations in commercial and non-profit sectors across Europe, USA and APAC. Its innovative cloud solutions and integrated AI software experience across multiple Access products transform how business technology is used. The company has over 9,300 employees.
