Role Summary
We are looking for an experienced GRC professional with a proven AI governance skillset to build and operate the organization's AI Governance program.
This is not an “AI enthusiast learning GRC” — it is a grounded GRC/Information Security practitioner who has spent 6–10 years running risk, compliance, and audit work, and has extended that discipline into AI systems: LLMs, ML models, AI-embedded vendor products, and internally built AI tools.
Hands-on knowledge of ISO/IEC 42001:2023 (AI Management System) is mandatory for this role.
The successful candidate will own the AI risk taxonomy, control framework, regulatory mapping, and reporting cadence for AI systems across their lifecycle — while integrating this into the existing ISMS/GRC structure rather than building it as a silo.
Key Responsibilities
AI Governance Program & Framework Ownership
Design and operate the enterprise AI Governance Framework, aligned to ISO/IEC 42001:2023, NIST AI RMF 1.0, and internal risk appetite statements.
Define AI governance scope: what counts as an “AI system” for governance purposes (embedded AI features, GenAI/LLM tools, classical ML, third-party AI SaaS, RPA-with-AI, etc.).
Build and maintain an AI system/model inventory — owner, purpose, data sources, risk tier, deployment status, review cadence.
Establish a risk-tiering methodology (e.g., unacceptable / high / limited / minimal risk, mirroring EU AI Act categories) and apply it consistently across use cases.
Define governance gates across the AI lifecycle: intake risk assessment approval deployment monitoring periodic re-assessment decommissioning.
Integrate AI governance controls into the existing GRC/ISMS control library (map to ISO 27001 Annex A, NIST CSF, SOC 2 where overlap exists — avoid duplicate control sets.
Regulatory & Standards Compliance
Drive ISO/IEC 42001 readiness and certification efforts — gap assessment, documentation build-out, internal audit, management review, and external audit liaison (mandatory competency for this role).
Maintain authoritative tracking of applicable AI regulation: EU AI Act (obligations by risk tier, timelines, conformity assessment requirements), NIST AI RMF, sector-specific guidance, and emerging US state-level AI laws (e.g., Colorado AI Act).
Support regulatory horizon-scanning: convert new regulatory text into internal obligation registers and control gap assessments.
Ensure alignment with data protection law where AI intersects with personal data (GDPR Art. 22 automated decision-making, DPIAs for AI processing).
Produce regulatory applicability matrices per business unit/geography.
Policy, Standards & Control Development
Author and maintain the AI governance policy suite: AI Acceptable Use Policy, Responsible/Ethical AI Principles (fairness, transparency, accountability, human oversight, safety), AI Model Risk Management Standard, Generative AI Usage Policy (including data leakage, IP, hallucination handling), Third-Party AI Vendor Risk Standard.
Build a control library specific to AI risks: data quality/bias controls, explainability requirements, human-in-the-loop checkpoints, model validation and testing standards, change management for models.
Define approval authorities and escalation paths by risk tier (e.g., high-risk use cases require Risk Committee sign-off).
AI Risk Assessment & Third-Party AI Risk
Design and execute AI-specific risk assessments for internal builds and vendor/AI SaaS tools — covering bias/fairness, explainability, robustness, data provenance, security (prompt injection, model exfiltration), privacy, and IP/copyright exposure.
Extend the existing TPRM program to include AI-specific due diligence questionnaires for vendors embedding or offering AI capabilities (foundation model providers, AI-enabled SaaS).
Review vendor model cards, system cards, and AI documentation as part of due diligence; flag gaps in vendor transparency.
Partner with Legal/Procurement on AI-specific contract clauses (data usage rights, liability, audit rights, model update notifications).
Assurance, Monitoring & Reporting
Define KPIs/KRIs for AI governance maturity (e.g., % of AI use cases risk-assessed, time-to-approval, open AI-related audit findings, vendor AI risk exposure).
Build and present CISO/Risk Committee-level dashboards on AI risk posture.
Support internal/external audits scoped to AI governance and ISO 42001 controls.
Establish periodic model monitoring cadence in partnership with Data Science/MLOps — drift, performance degradation, bias re-testing.
Operate the AI incident response process — classification of AI-related incidents (hallucination-driven errors, data leakage via GenAI tools, model failure), root cause tracking, and reporting.
Stakeholder Management, Training & Culture
Act as the primary liaison between GRC, Legal, Data Science/Engineering, Procurement, and leadership on AI risk matters.
Design and deliver AI risk awareness training tailored by audience (developers/data scientists vs. general employees vs. leadership).
Represent AI governance maturity in client-facing conversations where relevant (e.g., vendor assurance, RFP responses).
Support and coach junior GRC analysts on AI-specific assessment methodology.
Required Experience & Competencies
Core GRC / IS Experience: 6–10 years in GRC, Information Security, IT Risk, or Compliance, including hands-on ownership of risk assessments, control frameworks, and audit support.
AI Governance Skillset (Mandatory): Demonstrable AI governance capability — AI risk assessment, AI policy development, AI system inventory/risk-tiering, or GenAI usage governance — built on a solid GRC foundation (“GRC professional with an AI skillset”).
ISO/IEC 42001 (Mandatory): Working command of ISO/IEC 42001:2023 (AI Management System) — gap assessments, documentation build-out, internal audit, or certification readiness. Lead Implementer/Auditor credential strongly preferred.
Regulatory Depth: Working knowledge of NIST AI RMF 1.0, EU AI Act obligations by risk tier, GDPR Art. 22 (automated decision-making), and emerging US state-level AI laws.
Framework Breadth: Solid grounding in ISO 27001, NIST CSF, SOC 2; familiarity with NIST 800-53/800-171 or HITRUST a plus; sound TPRM methodology.
Program Contribution: Experience building or significantly maturing GRC program components — policies, risk registers, control libraries, assessment methodologies.
Communication & Reporting: Able to build management-level dashboards and present AI risk posture to CISO/Risk Committee audiences.
Technical Translation: Able to translate AI/ML concepts (bias, hallucination, drift, explainability, prompt injection) into risk and control language for non-technical stakeholders.
Cross-Functional Influence: Proven ability to drive outcomes across Legal, Data Science, Engineering, and Procurement without formal authority.
Preferred Qualifications
- Certifications: ISO/IEC 42001 Lead Implementer/Auditor (strongly preferred), AIGP (IAPP), CISA, CRISC, CISM, ISO 27001 Lead Auditor.
- Direct experience contributing to or leading an ISO/IEC 42001 certification or readiness effort (not just familiarity).
- Experience in regulated industries: financial services, insurance, healthcare, or tech/SaaS.
- Exposure to MLOps/model inventory tooling from a governance (not engineering) lens.
- Prior experience producing regulatory applicability matrices across multiple geographies/frameworks.
- Experience working effectively in fully remote, distributed teams.
Education
- Bachelor's degree in Information Security, Computer Science, Law, Risk Management, or related field.
- Master's degree preferred, not mandatory.