Learn / Advisory and customer-facing delivery skills

Advisory and customer-facing delivery skills

Explaining AI risk and controls to clients and leadership, and delivering advisory work they can act on.

7 of 48postings ask for it (15%)

AI Security Consultant40%of 5 AI Security Architect29%of 7 AI Governance and Risk Lead14%of 7 AI Security Engineer12%of 16 AI Security Researcher0%of 4 AI Red Teamer0%of 9

Researched on 2026-09-26 with AI assistance. Links and summaries can change; verify details with the original source. Not yet reviewed by a person.

What it is

Advisory and customer-facing delivery is the work of turning AI security findings into decisions other people can make: scoping an engagement, writing the assessment, and briefing product owners, risk committees and boards. Public guidance exists for exactly this gap: the UK NCSC Cyber Security Toolkit for Boards is built around the Cyber Governance Code of Practice and is designed to support the discussions between a board and its technical experts.³

The writing and speaking part is a learnable craft, not a personality trait. Google's free Technical Writing One course teaches the specific moves that make advisory documents usable: state key points at the start, identify what your audience already knows and needs to learn, prefer active voice, and break long topics into sections.⁸

Credible advice is anchored to published references the client can check for themselves, rather than to your opinion. In practice that means NIST's AI Risk Management Framework, which is voluntary and organised around four functions (govern, map, measure, manage), ISO/IEC 42001:2023 for an AI management system, and the article-by-article obligations of Regulation (EU) 2024/1689.²⁹

It also means being straight about what your testing does and does not prove. Microsoft's write-up of red teaming over 100 generative AI products states plainly that AI red teaming is not safety benchmarking, that responsible AI harms are pervasive but hard to measure, and that the work of securing AI systems is never complete.⁵

Why postings ask for it

7 of 48 postings (15%) ask for advisory and customer-facing delivery skills, and the concentration matters more than the average: 40% of the 5 consulting and field delivery postings and 29% of the 7 AI security architect postings ask for it.^P

Demand is near zero in the hands-on testing clusters (0% of 9 AI red team postings and 0% of 4 research postings) but present in AI/agent security engineering (12% of 16) and AI governance and GRC (14% of 7), which reflects who has to defend a decision in front of a client or a risk committee rather than only produce findings.^P

The underlying work is documentation and scoping: deciding whether a client is a provider or a deployer, writing the risk management, technical documentation, human oversight and transparency story the regulation expects, and handing over something auditable.⁹^P

Concepts you should be able to explain

If you can say each of these out loud in two minutes, with an example, you are ready for the technical part of an interview on this skill.

Audience-first document structure

Advisory documents fail when the reader has to hunt for the decision. Technical Writing One's rules are the minimum bar: state key points at the start of the document, state scope and audience explicitly, work out what the target audience already knows, and watch for the curse of knowledge that makes you skip the context they need.⁸

Board-level risk conversation

Boards need to govern AI and cyber risk without becoming engineers. The NCSC toolkit is organised around five principles of the Cyber Governance Code of Practice (risk management, strategy, people, incident planning and response, assurance and oversight) and includes modules on identifying critical assets and on supply chain risk, which gives you a ready agenda structure for an executive session.³

Shared risk vocabulary from AI RMF

The AI RMF Core has four functions: govern, map, measure and manage, with govern described as cross-cutting and infused through the others. NIST is explicit that the actions are not a checklist and not an ordered set of steps, so in advisory work you use the functions to structure findings and gaps, not to score a client. NIST also published NIST-AI-600-1, a generative AI profile, in July 2024.²¹

Provider versus deployer scoping

Under Regulation (EU) 2024/1689 the obligations differ by role: Article 16 covers providers of high-risk AI systems and Article 26 covers deployers, with Article 27 adding a fundamental rights impact assessment for some high-risk uses. The Commission's own AI Act Compliance Checker, currently in beta, helps users work out which rules may apply to providers, deployers and other operators, which is a defensible starting point for a scoping memo.⁹¹⁰

Control mapping instead of a homemade framework

The CSA AI Controls Matrix v1.1 contains 247 control objectives across 18 security domains and ships mappings to ISO 42001, ISO 27001, BSI AIC4, the EU AI Act and NIST AI RMF, plus role-specific implementation and auditing guidance for model provider, orchestrated service provider, application provider, AI customer and cloud service provider. NIST also publishes a crosswalk from AI RMF to ISO/IEC 42001 clauses, so you can show a client that one piece of evidence answers several frameworks.⁷¹⁴

Findings mapped to a named taxonomy

Clients challenge findings that look invented. The 2025 OWASP Top 10 for LLM and generative AI applications gives named entries you can cite, including prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. For attack narrative and threat framing, MITRE ATLAS data as of its 2026.08 release contains 16 tactics, 114 techniques, 83 sub-techniques, 39 mitigations and 72 case studies.⁴¹³

Honest limits on assurance

The lessons from red teaming over 100 generative AI products include: understand what the system can do and where it is applied, you do not need gradients to break an AI system, red teaming is not safety benchmarking, automation extends coverage but the human element is crucial, and LLMs both amplify existing security risks and introduce new ones. Saying this up front prevents a client reading your report as a clean bill of health.⁵

Deliverable artefacts that survive handover

Model cards, proposed by Mitchell and colleagues, are short documents accompanying a trained model that record intended use context, benchmarked evaluation across relevant groups and conditions, and the evaluation procedures used. On the data protection side the ICO's AI and data protection risk toolkit sets out controls, control objectives, risk indicators and suggested evidence or documentation, which is the level of specificity a client can actually action.⁶¹²

Use fictional data and authorised sandboxes. Remove employer details and secrets from any portfolio write-up. Time estimates exclude setup. Check model and cloud costs before running tests, set spending limits, and delete lab resources afterwards.

Three exercises

In order of difficulty. Free tools. Keep what you build; it is evidence.

1One-page risk brief for a non-technical sponsorabout 3 h

A single page that names three risks in an LLM feature, their business consequence and the decision you are asking for, written to a stated audience and scope.⁴⁸⁵

Pick a concrete feature, for example a support chatbot with access to a ticket database.
Choose three entries from the 2025 OWASP Top 10 for LLM and generative AI applications and write each in one sentence of plain English.
Work the Technical Writing One rules through a draft: key points first, stated scope and audience, active voice, short sentences.
Add one paragraph on what your assessment did not cover, using the point that red teaming is not safety benchmarking.
Read it aloud to a non-specialist and cut anything you have to verbally explain.

Tools: web browser, text editor, Google Technical Writing One (free), OWASP Top 10 for LLM and Gen AI (free)

2Scoping and control-mapping memo for a client use caseabout 5 h

A two-page memo that states whether the client acts as provider or deployer, lists likely obligations, maps them to named controls and asks for specific evidence.¹⁰⁹⁷

Write a short use case description, including who builds the model, who deploys it and which users are affected.
Run the description through the Commission's AI Act Compliance Checker beta and record which rules it flags for providers and deployers.
Open the relevant articles in the AI Act Explorer, for example Article 9 risk management, Article 11 technical documentation, Article 14 human oversight and Article 26 deployer obligations, and quote the obligation you rely on.
Select the matching control objectives from the CSA AI Controls Matrix and use its ISO 42001 and NIST AI RMF mappings to show one evidence item covering several frameworks.
Close with an evidence request list and a list of open questions you would escalate to legal counsel rather than answer yourself.

Tools: web browser, EU AI Act Compliance Checker (free beta), AI Act Explorer (free), CSA AI Controls Matrix v1.1 (free download), spreadsheet

3Run a stakeholder tabletop on an AI agent incidentabout 8 h

A 60-minute facilitated exercise plus an after-action note with prioritised actions and named owners.¹¹¹³⁴³

Take a CISA Tabletop Exercise Package as your structure; the packages are designed so stakeholders can adapt scenarios and conduct their own planning exercises.
Build the scenario from a named taxonomy: an indirect prompt injection reaching an agent with excessive agency, leading to sensitive information disclosure.
Add two injects grounded in MITRE ATLAS case studies and mitigations so participants argue about real technique classes.
Recruit three to five people in different roles (engineering, legal or privacy, communications, an executive) and facilitate without solving the problem for them.
Write the after-action note using board-level framing from the NCSC toolkit principles, with at most five actions, each with an owner and a date.
Send it within 48 hours and ask one participant whether they could act on it unaided.

Tools: CISA CTEP (free), MITRE ATLAS data (free), OWASP Top 10 for LLM and Gen AI (free), NCSC Cyber Security Toolkit for Boards (free), video call and text editor

Practice questions

Written from the concepts above, not collected from a named employer. Open one, answer it out loud, then tick the points you covered; the score stays in this browser.

A product team wants to add an LLM assistant to a customer portal. How would you scope the advisory engagement in the first week?Shared risk vocabulary from AI RMF; Honest limits on assurance