Cyber Security GRC

JOB PURPOSE MSC Group’s Cruise Division is recruiting a AI Security Specialist within the Cyber Security GRC department to provide specialist cybersecurity support for Artificial Intelligence (AI) and Machine Learning (ML) solutions throughout their lifecycle. The role will contribute to the maintenance and continuous improvement of the AI security control framework and will perform risk-based assurance of AI use cases, models, agents, copilots, APIs, data pipelines and third-party services, addressing confidentiality, integrity, availability, privacy, resilience and misuse risks. The specialist will combine governance knowledge with hands-on technical expertise, supporting the translation of business, risk and regulatory requirements into technical guardrails, testing criteria, logging and incident-response requirements for cloud, SaaS and internally developed AI solutions. The role will support the maintenance of the cybersecurity view of the enterprise AI inventory and contribute to Cyber AI risk classification, approval and exception assessments. Enterprise AI strategy, ethics, legal interpretation, model performance and business ownership remain with the relevant governance bodies and accountable functions. Close coordination is required with AI and Data Platform teams, Cloud Security, Application Security, IAM, Information Protection, Cyber Defense and SOC, Privacy, Legal, Procurement, Internal Audit and business owners to ensure that AI risks, controls, findings and remediation actions have clear ownership and traceable evidence. The role contributes specialist input to AI cybersecurity governance, design reviews and assurance activities within Cyber Security GRC, while control implementation, decision authority and day-to-day operations remain with the relevant governance, product, engineering, platform, SOC and managed-service teams under defined RACI and escalation paths. KEY ACCOUNTABILITIES AI Security Governance and Risk Management
• Contribute to the development and maintenance of the AI Cyber Security framework, policies, standards, minimum control baseline, acceptable-use security requirements and domain roadmap, aligned with the organization’s risk appetite, enterprise AI governance and applicable requirements such as the EU AI Act, ISO/IEC 42001 and NIST AI RMF.
• Support the maintenance of security attributes and assurance status for AI use cases and services within the enterprise inventory, including owners, providers, models, data sources, exposure, autonomy, criticality, dependencies and applicable control requirements.
• Perform cybersecurity risk assessments for AI-enabled solutions, models, agents and third-party services, documenting inherent and residual risk, proposed treatment actions, approval conditions and compensating controls for review by the relevant accountable owners.
• Support the recording and follow-up of AI-related security risks, exceptions, findings and risk-acceptance recommendations within the corporate GRC framework, helping ensure traceability, accountable owners, due dates, evidence and timely escalation.
• Prepare and maintain AI security KPI and KRI inputs covering inventory completeness, assessment and testing coverage, policy compliance, unresolved findings, exceptions, incidents and remediation performance, supporting management reporting on material risks. AI Security By Design
• Contribute to the definition and maintenance of security control requirements for machine-learning systems, large language models, Retrieval-Augmented Generation, vector databases, agents, plugins and tool calling, APIs, data pipelines and model endpoints.
• Support the review of AI solution architectures and configurations, covering identity and access management, least privilege, service identities, secrets, network controls, environment isolation, tenant boundaries, encryption, logging, administrative access and secure integration.
• Support the definition and application of data-protection requirements, including approved data sources, minimization, classification, DLP, retention, prompt and response handling, training restrictions and prevention of sensitive-data exposure.
• Contribute to security requirements for MLOps and LLMOps, including source-code, model, dataset and prompt provenance; dependency and artifact integrity; pipeline security; testing; release approval; change control; rollback and secure retirement.
• Assess third-party AI providers and components, addressing data use and training, subcontractors, residency, deletion, isolation, vulnerability management, incident notification, service continuity and exit requirements.
• Support validation of the implementation and effectiveness of security controls before production release and after material changes, documenting residual risks and following up on remediation or formal acceptance by the relevant accountable owners. . AI Security Testing, Monitoring and Incident Readiness
• Contribute to AI-specific security test scenarios covering prompt injection, jailbreaks, sensitive-data disclosure, insecure output handling, excessive agency, agent or plugin abuse, adversarial inputs, model poisoning, extraction or inversion, evasion and supply-chain compromise.
• Support the planning and execution of AI security testing, adversarial evaluations and red-team exercises with Application Security, engineering teams and specialist providers, defining scope, severity criteria, evidence and remediation expectations.
• Support the definition of privacy-aware logging, monitoring and telemetry requirements for prompts, outputs, model and API calls, administrative actions, data access, guardrail violations and abuse indicators, and assist with the integration of relevant detections into SOC processes.
• Support the development of AI security incident-response playbooks for data leakage, unauthorized or harmful actions, model or pipeline compromise, credential and secret exposure, provider incidents and uncontrolled or shadow AI usage.
• Monitor changes in AI threats, vulnerabilities, attack techniques and control guidance; translate lessons learned from tests and incidents into updated standards, secure patterns, awareness material and prioritized improvement actions. QUALIFICATIONS (skills, competencies, experience)
• Professional fluency in English and Italian, with the ability to prepare clear technical, governance and management documentation.
• Degree in Cybersecurity, Information Technology, Computer Science, Artificial Intelligence, Data Science, Engineering or a related discipline, or equivalent relevant professional experience.
• 2-5 years of relevant Cyber Security experience, including practical work in cloud, application, data or AI/ML security and demonstrated experience assessing or securing AI-enabled solutions in a complex organization.
• Strong working knowledge of AI, machine-learning and Generative AI architectures, including model training and inference, Retrieval-Augmented Generation, vector databases, agents, plugins, APIs, data pipelines and MLOps or LLMOps concepts.
• Hands-on experience performing security risk assessments and control design across the AI solution lifecycle.
• Understanding of AI-specific attack techniques and testing methods, including prompt injection, jailbreaks, data poisoning, model extraction or inversion, adversarial inputs, insecure output handling, excessive agency and AI supply-chain risk.
• Experience with cloud and enterprise AI platforms and their security capabilities, preferably including Microsoft Azure AI services, Azure OpenAI, Microsoft 365 Copilot or equivalent technologies.
• Good understanding of secure MLOps and LLMOps, software and model supply-chain security, API security, secrets management, logging, vulnerability management and secure-development practices.
• Good understanding of identity and access management, data classification and DLP, encryption, network security and privacy controls as they apply to AI systems.
• Knowledge of AI governance and security frameworks and applicable requirements, such as the EU AI Act, ISO/IEC 42001, NIST AI RMF, ISO/IEC 27001, GDPR, OWASP guidance for LLM applications and MITRE ATLAS.
• Experience defining security monitoring requirements, analyzing technical findings and supporting incident response, adversarial testing or red-team activities will be considered a strong advantage.
• Strong analytical, organizational and stakeholder-management skills, with the ability to influence technical and non-technical teams, manage concurrent assessments and communicate material risk clearly to senior management.
• Relevant certifications such as CISSP, CCSP, CISM, Microsoft SC-100, AZ-500 or AI-103, ISACA AAISM, IAPP AIGP, ISO/IEC 42001 Lead Auditor, ISO/IEC 27001 Lead Auditor or equivalent will be considered an advantage. VISA REQUIREMENTS Right to work in Italy.

WHAT WE OFFER
In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position. Contract
- Type of contract: Permanent
- Hybrid working model: 2 days per week remotely
- Applicable Collective Labour Agreement (CCNL): “Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l’armamento privato” – sez. personale di terra
- Gross annual salary (RAL): between €33.000 – €37.000 gross per year, paid over 14 monthly installments
- Meal vouchers: worth €8 per on-site working day The offer in terms of salary will be determined based on the candidate’s professional experience, technical competencies, and the level of autonomy and responsibility assigned to the role. Welfare&Wellbeing

We offer
a range of Welfare&Wellbeing Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible

working hours
, Employee Assistance Programme, Discounts & Partnerships within the MSC group. Our commitment We are committed to building a future that values diverse perspectives, embraces the world beyond borders, and fosters an inclusive environment where every individual feels valued, respected and empowered to be their authentic selves. Our commitment extends to taking meaningful, measurable actions that have a long-term positive impact on our guests, our employees and our planet. Ready to turn your passion into something extraordinary? Join us at MSC Cruises, where new opportunities await. Apply today to be part of a global team that is pushing boundaries and achieving something remarkable. Your journey starts here