Senior Information Security Architect – AI Security

Job Purpose

ABA Bank is seeking a Senior Information Security Architect with deep expertise in security architecture, risk management, network and platform security, and the secure adoption of artificial intelligence, combined with proven experience in the financial services industry.

Location

• Head Office, Phnom Penh (01 Post).

Major Areas of Responsibility

Security architecture and design authority

1. Define, maintain and communicate ABA's target security architecture, reference architectures, security design patterns and architectural standards spanning infrastructure, networks, applications, data, cloud and AI platforms.
2. Provide independent security design review and formal assurance for new systems, major changes, integrations and third-party services before they proceed through change approval, recording residual gaps as accepted risks with named owners.
3. Own and maintain the security architecture roadmap, aligning it to the Information Security strategy, the IT strategy and the Bank's business objectives, and identifying architectural debt for planned remediation.

Threat modelling and security risk assessment

1. Lead structured threat modelling for new and existing systems, prioritising internet-facing services, payment and core banking systems, privileged access paths and AI-enabled services.
2. Apply recognised methodologies (for example STRIDE, attack trees, and MITRE ATT&CK-informed adversary modelling) and translate technical findings into business risk statements with costed, proportionate treatment options.
3. Provide architectural input to risk assessments, control design and the Bank's information security risk register, and validate that agreed controls are actually effective in the deployed design.

AI security architecture and governance

1. Define the security architecture, control patterns and guardrails for the Bank's adoption of AI, covering model hosting and inference, data flows and residency, retrieval-augmented generation, prompt and output handling, tool and connector access, agentic autonomy limits, logging and human oversight points.
2. Assess AI use cases and platforms against recognised references including the OWASP Top 10 for LLM Applications (2026), the OWASP Top 10 for Agentic Applications, the NIST AI Risk Management Framework, MITRE ATLAS and ISO/IEC 42001.
3. Design architectural mitigations for AI-specific risk classes: prompt injection, sensitive information disclosure, excessive agency, data and model poisoning, supply chain compromise, improper output handling and unbounded consumption. Apply a containment-first principle: assume the model can be manipulated and constrain the blast radius accordingly.
4. Assure the AI supply chain, including model and dataset provenance, embedded AI features in third-party and SaaS products, plugins and connectors, and contractual controls over data use, retention and training.
5. Assess and advise on adversarial use of AI against the Bank and its customers, including deepfake-enabled fraud, AI-assisted social engineering and AI-accelerated malware development.
6. Support the secure and effective use of AI within the security function itself, and work with Data Governance, Legal, Compliance and Operational Risk to ensure AI deployments meet data protection and regulatory expectations.

Cloud, network and platform security architecture

1. Define secure architecture for hybrid and cloud environments, including identity-centric and zero trust design, network segmentation and micro-segmentation, secure connectivity, and workload and container security.
2. Set architectural standards for edge protection (WAF, DDoS mitigation, bot management, API security), remote access, and secure exposure of digital banking channels and APIs.
3. Set hardening baselines and secure configuration standards for Windows and Linux platforms, and define cryptographic standards, key and certificate management, and the Bank's roadmap towards post-quantum readiness.

Security technology evaluation and control selection

1. Evaluate, pilot and recommend security technologies and controls, assessing control efficacy, integration cost, operational burden and total cost of ownership, and avoiding duplication across the existing toolset.
2. Provide technical input to vendor due diligence, third-party risk assessment and concentration risk analysis, including assessment of vendors' own AI and security practices.

Regulatory compliance, audit and assurance

1. Ensure architectural compliance with NBC TCRMG, PCI DSS, SWIFT CSP, ISO/IEC 27001 and applicable parent-group standards, and interpret new or revised regulatory requirements into concrete architectural change.
2. Support internal audit, external audit, regulatory examinations and parent-company reviews with technical expertise, evidence and architecture documentation, and own remediation of architecture-related findings.
3. Maintain current, audit-ready architecture documentation, including data flow diagrams, trust boundaries and control mappings.

Advisory, enablement and stakeholder engagement

1. Act as trusted security adviser to IT, Digital, Data, Operations, Compliance and business stakeholders, engaging early in initiatives to shape design rather than block delivery.
2. Mentor development and infrastructure teams on secure design, secure coding and secure use of AI coding assistants, and contribute to security champion and community-of-practice activity.
3. Prepare and present architecture positions, risk decisions and technology recommendations to senior management and relevant governance committees.

Incident response, resilience and continuous improvement

1. Provide architectural input to incident response planning, playbooks and tabletop exercises, and act as an escalation point for architecture and design questions during major incidents.
2. Lead post-incident architectural root cause analysis and drive structural remediation rather than point fixes.
3. Interpret penetration test, red and purple team, threat intelligence and vulnerability findings for systemic architectural weakness, and feed conclusions back into standards and reference architectures.

Qualification

Education

1. Bachelor's degree in Computer Science, Information Technology, Engineering or a related discipline. A postgraduate qualification in information security or a related field is an advantage. Equivalent demonstrable experience will be considered.

Experience (essential)

1. Minimum 8 years in cybersecurity, infrastructure or software engineering, including at least 4 years in a dedicated security architecture role.
2. Demonstrable experience in banking, financial services or another regulated industry, with working knowledge of the sector's threat landscape and supervisory expectations.
3. Track record of producing security architecture artefacts that were adopted in production: reference architectures, design patterns, standards, threat models and design review outcomes.
4. Experience operating in a second-line or assurance capacity, exercising design authority and constructive challenge over teams the role holder does not manage.

Technical knowledge (essential)

1. Strong foundation in networking protocols, firewalls, VPNs, IDS/IPS, network segmentation and zero trust architecture.
2. Deep understanding of Windows and Linux operating systems, directory services, privileged access and platform hardening.
3. Practical experience with security architecture in cloud environments (AWS, Azure or Google Cloud), including identity, workload and data protection controls.
4. Working knowledge of SIEM, EDR, IAM and PAM, NAC, DLP, email and web security, and edge security platforms providing WAF, DDoS and bot protection (for example Cloudflare).
5. Sound grasp of application security, secure SDLC, API security and cryptography, including key and certificate management.
6. Expertise in risk management and control frameworks, for example NIST CSF and SP 800-53, ISO/IEC 27001 and 27002, ISO 31000, and governance frameworks such as COBIT.
7. Familiarity with financial sector regulatory requirements, including NBC TCRMG, PCI DSS and SWIFT CSP.

AI and emerging technology (essential or strongly desirable)

1. Demonstrable understanding of the security risks introduced by generative and agentic AI, and of the architectural controls that mitigate them.
2. Familiarity with AI security and governance references such as the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, the NIST AI Risk Management Framework, MITRE ATLAS and ISO/IEC 42001.
3. Understanding of how AI is embedded in enterprise and SaaS products, and of the data protection, residency and vendor-contractual questions this raises for a bank.
4. Evidence of continuous learning in this area, given the pace of change. Candidates without direct AI security experience but with strong architecture fundamentals and demonstrable capacity to build the capability will be considered.

Behavioural and professional competencies

1. Strong collaborative and consultative approach, with excellent influencing skills and the credibility to challenge senior technical stakeholders on evidence rather than authority.
2. Ability to explain complex technical risk clearly to non-technical audiences, including senior management and committees.
3. Sound commercial judgement, balancing security, cost, delivery timelines and business outcomes, and willing to document and escalate accepted risk rather than block indefinitely.
4. Fluent written and spoken English, with the ability to produce clear, professional architecture documentation, standards and reports to audit-ready quality.
5. Self-directed, comfortable with ambiguity, and able to hold a position under pressure.

Certifications

1. Essential: at least one of CISSP, CISM or CCSP, or equivalent demonstrable expertise.
2. Desirable: SABSA (SCF or higher), TOGAF, CISSP-ISSAP, Microsoft SC-100, GIAC (for example GDSA, GPCS, GCSA), OSCP or CREST registered qualifications, CISA or CRISC, CCNA or CCNP Security.
3. Desirable AI-specific: ISACA Advanced in AI Security Management (AAISM), ISO/IEC 42001 Lead Implementer or Lead Auditor.