Note: The job is a remote job and is open to candidates in USA. Orpine Inc is an Inc 5000 company seeking an experienced AI Governance & Application Security Consultant for a contract, project-based engagement. The consultant will independently review an internally developed AI-enabled application, assessing its architecture, security, privacy, data usage, third-party risks, and compliance considerations. The role will also help establish practical AI governance frameworks, policies, controls, and remediation plans for responsible AI adoption.
Responsibilities
- Review the business purpose, use cases, and intended users of an internally developed AI-enabled application
- Assess application architecture, hosting environment, and technical design
- Review AI models, services, APIs, and platforms incorporated into the application
- Evaluate data inputs, outputs, storage, retention, and data flows
- Review system integrations and external data exchanges
- Assess authentication, authorization, role-based access, and administrative controls
- Evaluate logging, monitoring, and application oversight capabilities
- Review development, testing, release, and deployment practices
- Review open-source software, third-party libraries, dependencies, and packages for potential risk
- Evaluate external APIs and third-party integrations
- Assess third-party AI models, platforms, and service providers
- Identify outdated or vulnerable components
- Evaluate software licensing considerations
- Review third-party data-sharing, storage, and retention practices
- Assess vendor and supply-chain security risks
- Provide prioritized recommendations for remediation
- Evaluate risks related to the use of confidential, institutional, student, patient, and employee information
- Assess potential exposure of personally identifiable information and protected health information
- Identify risks associated with data leakage or unintended disclosure
- Assess AI hallucination and inaccurate-output risks
- Review susceptibility to prompt manipulation, prompt injection, or inappropriate AI behavior
- Evaluate permissions and access controls
- Identify risks related to the use of confidential information within AI tools
- Recommend appropriate human oversight and review controls
- AI use-case approval and oversight
- AI roles and responsibilities
- Acceptable and prohibited AI uses
- Human-in-the-loop requirements
- AI risk classification
- Application testing and validation
- AI documentation standards
- Vendor and AI-tool evaluation
- Privacy and appropriate data-use requirements
- Ongoing monitoring and periodic review
- Incident escalation and response
- Responsible AI principles
- AI acceptable-use policies
- Responsible AI principles
- AI application review and approval processes
- Data classification guidelines
- Confidential-data handling standards
- Third-party AI evaluation checklists
- Human-in-the-loop requirements
- AI development, testing, and deployment standards
- Executive summary of findings
- AI application security and risk assessment
- Third-party dependency and integration risk assessment
- AI governance framework
- AI acceptable-use policy recommendations
- Data classification and privacy guidance
- AI application review and approval checklist
- Prioritized remediation plan
- Implementation roadmap
- Executive presentation and leadership working session
Skills
- 7+ years of experience in cybersecurity, application security, cloud security, AI/ML architecture, technology risk, or related areas
- Demonstrated experience assessing AI-enabled or machine-learning applications
- Strong understanding of generative AI, large language models, AI APIs, and modern AI application architecture
- Experience reviewing application architecture, integrations, APIs, authentication, authorization, logging, and monitoring
- Strong understanding of secure software development practices and application security principles
- Experience evaluating open-source libraries, third-party dependencies, and software supply-chain risks
- Strong knowledge of data privacy, data classification, and sensitive-data handling
- Experience developing or implementing technology governance, security standards, or risk frameworks
- Ability to identify technical risk and translate findings into practical remediation recommendations
- Strong written communication skills and ability to prepare executive-level findings and presentations
- Ability to collaborate with developers, IT leadership, cybersecurity professionals, legal/compliance stakeholders, and executive leadership
- HIPAA
- FERPA
- PCI DSS
- PII and PHI protection
- Healthcare security and privacy
- Higher education technology environments
- NIST cybersecurity frameworks
- NIST AI Risk Management Framework
- Responsible AI governance
- Data privacy and security risk management
- Experience conducting AI risk assessments or AI governance engagements
- Experience evaluating generative AI or LLM-based applications
- Knowledge of prompt injection, model manipulation, hallucination, data leakage, and other emerging AI risks
- Experience with cloud platforms such as Azure, AWS, or Google Cloud
- Familiarity with Microsoft Azure AI, Azure OpenAI, Microsoft Copilot, or similar enterprise AI environments
- Understanding of secure SDLC, DevSecOps, API security, and vulnerability-management practices
- Experience working in healthcare, higher education, or other regulated environments
- Experience developing AI policies, responsible-AI frameworks, or AI review processes
- AI technology + application security + privacy + governance + business risk
- This individual should be comfortable reviewing how an AI application actually works technically, identifying security and privacy risks, and then helping leadership establish practical policies, controls, and a roadmap for responsible AI adoption
- Strong experience with one or more of the following is highly preferred:
Benefits
- Remote work arrangement
- Contract / Project-Based employment
- 20 hours a week
- Initial engagement duration of 3–6 months
- Potential for additional work related to future AI application reviews, AI governance advisory support, policy implementation, remediation oversight, vendor and AI-tool evaluations, security and privacy assessments, and ongoing specialized AI and cybersecurity advisory services
Company Overview
Company H1B Sponsorship