Xabier Muruaga
Global Head of AI & Data @ Iberdrola · AI Security Architect · Adjunct Professor @ IE University
I architect secure AI and agentic systems for production, where security, governance and assurance are first-class architectural requirements. That work builds on more than a decade designing and securing regulated energy and critical-infrastructure platforms serving millions of customers, later extending that foundation into cloud and enterprise AI architecture.
At Iberdrola, I lead global AI and Data architecture, security and technical governance, shaping the platform foundations behind GenAI and agentic initiatives at one of the world's largest regulated energy operators. A major part of my work translates AI security risks into enforceable controls, verification criteria and assurance evidence aligned with OWASP LLM and agentic AI guidance, MITRE ATLAS, CSA MAESTRO, NIST AI RMF, the EU AI Act and ISO/IEC 42001.
I contribute to industry standards as a founding consortium member of AIUC-1, contributor to the OWASP GenAI Security Project, and member of the CSA AI Safety Working Group. I also teach AI Systems at IE University, with a focus on the architecture and controls required to operate AI safely at scale.
Experience
AI Safety Working Group Member
Contributing to practical guidance on AI threat modeling, security controls, and risk frameworks for enterprise AI, LLM, and agentic systems.
Technologies & Skills
GenAI Security Project Contributor
Contributing to OWASP GenAI security work across the Top 10 for LLM Applications, Top 10 for Agentic AI, AI threat modeling, and agentic identity and delegation. Focus areas include authorization controls, delegated authority, runtime policy enforcement, irreversible-action governance and secure production adoption.
Technologies & Skills
Founding Consortium Member
Founding member of the AIUC-1 consortium, working with 50 leaders across industry and academia to shape standards for agentic AI governance, security, assurance, and safe production deployment.
Technologies & Skills
Adjunct Professor – AI Systems
Design and teach AI Systems within the Master in Business Analytics and Data Science, focused on how production-grade AI systems are designed, governed, secured and operated at scale. The course covers AI architecture, ML/LLM system design, secure-by-design delivery, evaluation, observability, platform patterns, AI security risks, governance and production assurance.
Technologies & Skills
Global Head of AI & Data
Leading Iberdrola's Global AI & Data Center of Excellence. Mandate: turn AI from isolated PoCs into a repeatable, secured production capability across businesses and geographies.
Key Achievements
- Delivered secure production AI foundations across Azure and AWS, enabling RAG and agentic systems with controls for prompt injection, data leakage, evaluation gates, and end-to-end observability.
- Industrialized reusable building blocks including LLM gateway, retrieval, tracing and telemetry, and policy-as-code guardrails to reduce time to production and improve consistency.
- Operationalized Responsible AI, AI Security, and assurance evidence through traceability, policy enforcement signals, evaluation controls, and decision records across the delivery lifecycle.
Technologies & Skills
Guest Lecturer – AI Security
Deliver guest lectures on AI Security, GenAI risk and secure AI adoption for the Master Degree in Entrepreneurship and Open Innovation, helping founders and innovation leaders understand how to design, govern and scale AI-enabled products safely.
Technologies & Skills
Global AI Architecture & Security Lead
Defined the secure-by-design AI platform architecture across Azure and AWS as Iberdrola moved into GenAI, covering secure cloud architecture, IAM and authorization, permissioned retrieval and RAG delivery standards, secure SDLC and supply-chain controls, evaluation gates and production readiness. Turned these into reusable patterns adopted across business units, with consistent governance, observability and threat modeling.
Key Achievements
- Defined scalable, enterprise-wide reference architectures across AWS and Azure, strengthening security, reliability, and platform standards.
- Shipped early AI foundations (access patterns, shared services, governance gates) adopted across multiple teams.
- Defined practical Responsible AI implementation guidance and controls for production delivery.
Technologies & Skills
Head of Architecture & Security, Energy Solutions
Led architecture and security for customer-facing energy platforms across smart home, solar and EV charging, supporting millions of users and critical retail operations. Defined secure platform architecture, IAM and access boundaries, CRM and Salesforce integration patterns, telemetry, resilience and controlled rollout standards, while introducing automation and early AI-enabled decision systems across customer operations.
Key Achievements
- Scaled smart solution products to millions of users across multiple countries.
- Launched internal automation platforms for critical business processes, significantly improving operational efficiency.
- Increased customer acquisition by significantly improving digital experiences and scalability.
Technologies & Skills
Head of Architecture & Cyber Security, Smart Meters
Led architecture and cybersecurity for regulated metering, billing and industry platforms supporting millions of customers in the UK. Defined the technical roadmap for Smart Metering platforms, SAP IS-U/CRM integrations and data-driven operational systems, strengthening access control, auditability, traceability, data integrity, operational resilience and reliability across critical business processes.
Key Achievements
- Defined technical roadmap and architecture for Smart Metering platforms at scale.
- Introduced advanced analytics and decision-support capabilities for metering operations and forecasting.
- Significantly reduced billing errors through improved data processing and system integration.
Technologies & Skills
Senior Systems Analyst, Secure Enterprise Integration
Drove technical design and secure integration of large-scale enterprise systems, modernizing complex legacy platforms through SAP IS-U and CRM integration. Defined scalable integration patterns that improved reliability, data consistency, traceability, auditability and operational visibility across regulated metering operations.
Key Achievements
- Delivered large-scale consolidation of legacy systems into a unified SAP IS-U/CRM platform.
- Defined scalable integration patterns improving reliability and data consistency.
- Improved operational visibility across metering operations.
Technologies & Skills
Technology Strategy Consultant
Advised IBEX-35 clients on technology strategy, focusing on transformation programs and digitalization initiatives. Designed and led delivery of impactful technology solutions, including an inter-company reconciliation system that streamlined month-end financial processing. Consulted directly with C-level stakeholders to align technology delivery with evolving business needs.
Key Achievements
- Designed and delivered an inter-company reconciliation system for an IBEX-35 client.
- Materially reduced month-end financial processing time.
- Consulted with C-level stakeholders to align technology delivery with strategic business objectives.
Technologies & Skills
Independent IT Consultant (Freelance)
Provided end-to-end IT consulting and systems integration services for small and medium-sized business clients, covering requirements, solution design, implementation and delivery governance. Managed the full client lifecycle from scope definition and proposals to implementation, quality control and handover.
Technologies & Skills
Software Engineer
Engineered enterprise applications for clients in the energy and insurance sectors. Built a real-time wind-farm monitoring platform for a major Spanish utility. Contributed across the full software development lifecycle, from requirements and architectural design through to implementation, testing, and deployment.
Key Achievements
- Engineered a real-time monitoring platform for wind farms from the ground up.
- Implemented a Java EE solution with robust, high-performance data processing capabilities.
- Delivered the system successfully for a major Spanish utility company.
Technologies & Skills
Architecture & Security Focus Areas
Enterprise AI Architecture
AI Security Architecture
Governance & Compliance
Cloud & Platform
Certifications
Professional Certifications
Threat Modeling AI/ML Systems
IriusRisk • 2026
AI Governance
Saïd Business School, University of Oxford • 2026
Generative AI: Governance, Policy, and Emerging Regulation
University of Michigan • 2026
Auditing Generative AI: Strategy, Analysis & Risk Mitigation
ISACA • 2025
MLOps Zoomcamp
DataTalksClub • 2025
Machine Learning in Production
DeepLearning.AI • 2025
AI Agents
Hugging Face • 2025
Data Engineering Specialization
Amazon Web Services • 2024
Microsoft Certified: Azure AI Engineer Associate
Microsoft • 2024
NVIDIA AI Infrastructure and Operations
NVIDIA • 2024
Responsible AI
Google Cloud • 2024
Generative AI for Executives and Business Leaders
IBM • 2024
Computer Vision
Kaggle • 2024
AWS Certified Solutions Architect – Associate
Amazon Web Services • 2023
Microsoft Certified: Azure Solutions Architect Expert
Microsoft • 2023
Microsoft Certified: Azure Administrator Associate
Microsoft • 2023
HashiCorp Certified: Terraform Associate
HashiCorp • 2023
Generative AI with Large Language Models
DeepLearning.AI • 2023
Machine Learning Certificate
Stanford Online • 2016
Education
Universidad Internacional de La Rioja
2023 - 2024MSc, Artificial Intelligence
GPA: 4.0/4.0. Thesis: ML/DL classification of hazardous asteroids (European ADELA project). Focus on applied ML and model evaluation across end-to-end AI pipelines.
EOI Business School
2011 - 2013Executive MSc, Business
Executive MSc focused on business strategy, operating models, and tech-driven transformation.
Tilburg University
2010 - 2011MSc, Computer Science & Industrial Engineering (Exchange)
International exchange. Computer science, systems engineering, and applied optimization.
University of Deusto
2004 - 2011MSc, Computer Science & Industrial Engineering
Dual degree. Final thesis: Scalable peer-to-peer platform in Python (top distinction 10/10). Strong base in distributed systems and software architecture.