Audit Director – AI Technology, Cyber, Data and GenAI Engineering

The Audit Director – AI Technology, Cyber, Data and GenAI Engineering is a senior level management position, reporting to the Chief Auditor Artificial Intelligence (AI) Assurance, responsible for managing a team of audit professionals with an overall objective to strategically direct audit activities and assessments of the risk and control environment for the adoption of AI/GenAI, specifically related to AI Technology, Cyber, Data and GenAI Engineering.

This role will primarily focus on AI Technology, Cyber, Data and GenAI Engineering with the overall objective of this role to ensure that Citi Internal Audit’s approach to AI to position Citi IA as the leading IA function in the financial services industry.

Citi IA is a dynamic global function of over 2,500 professionals located across more than 60 countries, covering Citi's global businesses and service to clients and customers through its network in 98 countries. Through a culture of continuous improvement, Citi IA is focused on maintaining its position as a best-in-class IA function and is committed to investing in people, learning and development, innovation, and methodology programs. The Internal Audit mission is to provide independent, objective, reliable, valued and timely assurance to the Board, senior management and regulators of Citigroup and Citibank (and its subsidiaries), over the effectiveness of culture, ethical conduct, governance, risk management, and controls that mitigate current and evolving risks and to enhance the control environment.  IA is a change agent within Citi to enhance the control culture of Citigroup worldwide and therefore support senior management decision making around the globe.

Citi operates in over 100 countries and provides consumers, corporations, governments, and institutions with a broad range of financial services and products. Citi strives to create the best outcomes for clients and customers with financial ingenuity that leads to solutions that are simple, creative, and responsive.

Responsibilities:

• Develop the strategy and direct the execution of a portfolio of concurrent assurance activities relating to AI Technology, Cyber, Data and GenAI Engineering, of high quality, within budget, and within the expected timelines.
• Act as a trusted subject matter experts on AI Technology, Cyber, Data and GenAI Engineering in financial services across the IA team.
• Partner with IA Technology and Business Enablement team to scale AI assurance across IA work programs.
• Lead and support AI audit engagements, ensuring that AI/GenAI systems are assessed against good architectural practices, security and safety design applicable to AI, GenAI and agentic AI.  
• Assessing GenAI platforms and tooling including vector databases, storage, orchestration frameworks, and GenAI-related infrastructure. This covers GPU and CPU usage patterns, compute and token cost optimisation, efficient resource utilisation, plugins and GenAI API ecosystems, infrastructure for evaluations and testing, version control, GenAI system lifecycle management, sandboxing environments, and promotion from development to production.
• Assessing security and safety controls for AI, GenAI and agentic AI implementation. This will include reviewing cyber security controls, use-cases specific guardrails.
• Assessing approaches for red-teaming, safety testing, alerting.  
• Assessing suitability of testing, reviews and validation of AI, GenAI and agentic AI from infrastructure, cyber security point of view.
• Assessing internal and external integration, use of AI / GenAI based APIs, gateways from stability, security point of view    
• Assessing GenAI observability and monitoring focusing on telemetry specific to GenAI and agentic systems, including per-prompt traces, tool-call audit trails, safety events, and dashboards/alerts with immutable log retention.
• Evaluating resilience, disaster recovery of AI, GenAI and agentic systems, focusing on failure scenarios, recovery procedure. Ensuring AI, GenAI and agentic systems are designed to be resilient and meeting business RTO and RPO requirements.
• Evaluating data pipelines, retrieval systems, and agentic workflows with attention to data integrity, privacy enforcement, misuse prevention, access management, encryption, resilience and recovery, and robustness under adversarial conditions such as data poisoning and denial-of-service attacks.
• Assessing data engineering, quality, and lineage across structured and unstructured data, including governanc