At Money Forward, we are driving company-wide business transformation through Generative AI (AX). This AI Security Lead position is dedicated within the AI Security Promotion Department as a practical implementation of the CISO Office’s security philosophy: “Autonomous and scalable organization of security” empowering each development team to build and operate secure services autonomously.
The AI Security Promotion Department has entered the phase of putting AI Agents into production as an enterprise-wide operational foundation. As external AI services like Claude, ChatGPT, and Cursor—along with internally built AI Agents and Skills—become deeply embedded in business operations across departments, there is a critical need for a dedicated lead capable of mitigating AI-specific security risks, including privilege escalation/boundary violations by agents, prompt injection, unauthorized data transfers, and hallucination control.
In this role, belonging to the AI Security Promotion Department, you will lead application- and service-layer security governance for AI Agents, Skills, and AI-enabled products developed and deployed across the company. Moving beyond conventional IT security, your mission will be to translate the company-wide security policies established by the CISO Office into the context of AI Agents, establishing an architectural and operational foundation that enables the safe and rapid deployment of AI.
Serving as a bridge between the CISO Office, Corporate IT, and Legal, you will oversee the entire AI Agent lifecycle—including design reviews, production deployment approvals, operational audits, and decommissioning. Additionally, you are expected to provide cross-functional leadership over security and operational responsibilities previously distributed across the department, encompassing vendor management for external AI tools, internal rollout and operational enablement, and the creation and maintenance of usage guidelines.
Responsibilities
AI Agent & Skill Security Governance
- Conduct security reviews across the lifecycle of internally developed and deployed AI Agents and Skills (design, production deployment, and decommissioning)
- Standardize agent permission design, including MCP connections, function calling, tool execution privileges, and data access boundaries
- Establish governance processes for the AI Agent lifecycle (standardizing design review criteria, production deployment approvals, and decommissioning protocols)
- Define agent audit logging and monitoring requirements, collaborating with Corporate IT (GIT) and the CISO Office to implement them into core infrastructure
Mitigation of AI-Specific Risks
- Design and implement countermeasures against prompt injection attacks
- Architect data leakage prevention measures
- Establish hallucination controls and output governance
- Design PII detection, masking, and filtering mechanisms
- Perform security risk assessments for third-party tool integrations
AI Governance & Security Architecture
- Develop AI Agent security standards and architectural guidelines in collaboration with the CISO Office
- Guide engineering teams in designing secure agent architectures
- Facilitate and streamline security review workflows for AI development teams
- Partner with the CISO Office, Legal, and Compliance departments
AI Enablement & Operational Support
- Provide security consultation and guidance to engineering and business divisions
- Build internal training programs and maintain security knowledge bases for AI Agents
- Evaluate and conduct risk assessments on emerging technologies and AI architectures
- Manage security evaluations and vendor management for external AI tools
- Develop and maintain company-wide AI usage guidelines
- Support the internal rollout and operational enablement of AI Agents and Skills
Requirements
- Experience in security design and architecture for web applications or cloud services
- Hands-on professional knowledge of AI/LLM services and tools (such as ChatGPT, Claude, and Cursor)
- Technical literacy and deep understanding of AI Agents and agent architectures
- Experience conducting security reviews or architectural reviews
- Proven track record of driving cross-functional projects in collaboration with engineering and business teams
- Language requirements
- Japanese: Business level (equivalent to JLPT N2 or above) / Strong written and verbal communication skills
- English: Business level (equivalent to TOEIC 700 or above) / Ability to lead vendor negotiations and technical research
- If you do not have a qualification equivalent to TOEIC 700 or above, you will be required to take a company-designated test during the selection process.
Nice to haves
While not specifically required, tell us if you have any of the following.
- Experience conducting risk assessments for AI Agents or LLM services in production environments
- Solid technical understanding of agent integration technologies, including MCP, Function Calling, and Tool Use
- Knowledge of Zero Trust architecture, IAM, DLP (Data Loss Prevention), and audit logging
- Professional English proficiency for researching technical documentation and communicating with vendors
- Experience in AI development and/or experience in using AI tools to improve development processes.
Compensation
¥6,900,000 ~ ¥11,004,000 annually.