AI Governance Specialist GRC (AI Risk & Compliance)

Location: Remote
Experience Level: Mid-Senior (6–10 years)
1. Role Summary
We are looking for an experienced GRC professional with a proven AI governance skillset to build and
operate the organization''s AI Governance program. This is not an “AI enthusiast learning GRC” — it is a
grounded GRC/Information Security practitioner who has spent 6–10 years running risk, compliance, and
audit work, and has extended that discipline into AI systems: LLMs, ML models, AI-embedded vendor
products, and internally built AI tools.
Hands-on knowledge of ISO/IEC 42001:2023 (AI Management System) is mandatory for this role. The
successful candidate will own the AI risk taxonomy, control framework, regulatory mapping, and reporting
cadence for AI systems across their lifecycle — while integrating this into the existing ISMS/GRC structure
rather than building it as a silo.
2. Key Responsibilities
2.1 AI Governance Program & Framework Ownership
• Design and operate the enterprise AI Governance Framework, aligned to ISO/IEC 42001:2023, NIST AI
RMF 1.0, and internal risk appetite statements
• Define AI governance scope: what counts as an “AI system” for governance purposes (embedded AI
features, GenAI/LLM tools, classical ML, third-party AI SaaS, RPA-with-AI, etc.)
• Build and maintain an AI system/model inventory — owner, purpose, data sources, risk tier,
deployment status, review cadence
• Establish a risk-tiering methodology (e.g., unacceptable / high / limited / minimal risk, mirroring EU AI
Act categories) and apply it consistently across use cases
• Define governance gates across the AI lifecycle: intake → risk assessment → approval → deployment
→ monitoring → periodic re-assessment → decommissioning
• Integrate AI governance controls into the existing GRC/ISMS control library (map to ISO 27001 Annex
A, NIST CSF, SOC 2 where overlap exists — avoid duplicate control sets)
2.2 Regulatory & Standards Compliance
• Drive ISO/IEC 42001 readiness and certification efforts — gap assessment, documentation build-out,
internal audit, management review, and external audit liaison (mandatory competency for this role)
• Maintain authoritative tracking of applicable AI regulation: EU AI Act (obligations by risk tier, timelines,
conformity assessment requirements), NIST AI RMF, sector-specific guidance, and emerging US statelevel AI laws (e.g., Colorado AI Act)
• Support regulatory horizon-scanning: convert new regulatory text into internal obligation registers and
control gap assessments
• Ensure alignment with data protection law where AI intersects with personal data (GDPR Art. 22
automated decision-making, DPIAs for AI processing)
• Produce regulatory applicability matrices per business unit/geography
2.3 Policy, Standards & Control Development
• Author and maintain the AI governance policy suite:
◦ AI Acceptable Use Policy
◦ Responsible/Ethical AI Principles (fairness, transparency, accountability, human oversight, safety)
◦ AI Model Risk Management Standard
◦ Generative AI Usage Policy (including data leakage, IP, hallucination handling)
◦ Third-Party AI Vendor Risk Standard
• Build a control library specific to AI risks: data quality/bias controls, explainability requirements,
human-in-the-loop checkpoints, model validation and testing standards, change management for
models
• Define approval authorities and escalation paths by risk tier (e.g., high-risk use cases require Risk
Committee sign-off)
2.4 AI Risk Assessment & Third-Party AI Risk
• Design and execute AI-specific risk assessments for internal builds and vendor/AI SaaS tools — covering
bias/fairness, explainability, robustness, data provenance, security (prompt injection, model
exfiltration), privacy, and IP/copyright exposure
• Extend the existing TPRM program to include AI-specific due diligence questionnaires for vendors
embedding or offering AI capabilities (foundation model providers, AI-enabled SaaS)
• Review vendor model cards, system cards, and AI documentation as part of due diligence; flag gaps in
vendor transparency
• Partner with Legal/Procurement on AI-specific contract clauses (data usage rights, liability, audit rights,
model update notifications)
2.5 Assurance, Monitoring & Reporting
• Define KPIs/KRIs for AI governance maturity (e.g., % of AI use cases risk-assessed, time-to-approval,
open AI-related audit findings, vendor AI risk exposure)
• Build and present CISO/Risk Committee-level dashboards on AI risk posture
• Support internal/external audits scoped to AI governance and ISO 42001 controls
• Establish periodic model monitoring cadence in partnership with Data Science/MLOps — drift,
performance degradation, bias re-testing
• Operate the AI incident response process — classification of AI-related incidents (hallucination-driven
errors, data leakage via GenAI tools, model failure), root cause tracking, and reporting
2.6 Stakeholder Management, Training & Culture
• Act as the primary liaison between GRC, Legal, Data Science/Engineering, Procurement, and leadership
on AI risk matters
• Design and deliver AI risk awareness training tailored by audience (developers/data scientists vs.
general employees vs. leadership)
• Represent AI governance maturity in client-facing conversations where relevant (e.g., vendor
assurance, RFP responses)
• Support and coach junior GRC analysts on AI-specific assessment methodology
3. Required Experience & Competencies
Competency Area Requirement
Core GRC / IS Experience 6–10 years in GRC, Information Security, IT Risk, or Compliance, including
hands-on ownership of risk assessments, control frameworks, and audit
support
AI Governance Skillset
(Mandatory)
Demonstrable AI governance capability — AI risk assessment, AI policy
development, AI system inventory/risk-tiering, or GenAI usage
governance — built on a solid GRC foundation (“GRC professional with an
AI skillset”)
ISO/IEC 42001 (Mandatory) Working command of ISO/IEC 42001:2023 (AI Management System) —
gap assessments, documentation build-out, internal audit, or certification
readiness. Lead Implementer/Auditor credential strongly preferred
Regulatory Depth Working knowledge of NIST AI RMF 1.0, EU AI Act obligations by risk tier,
GDPR Art. 22 (automated decision-making), and emerging US state-level
AI laws
Framework Breadth Solid grounding in ISO 27001, NIST CSF, SOC 2; familiarity with NIST 800-
53/800-171 or HITRUST a plus; sound TPRM methodology
Program Contribution Experience building or significantly maturing GRC program components
— policies, risk registers, control libraries, assessment methodologies
Communication & Reporting Able to build management-level dashboards and present AI risk posture
to CISO/Risk Committee audiences
Technical Translation Able to translate AI/ML concepts (bias, hallucination, drift, explainability,
prompt injection) into risk and control language for non-technical
stakeholders
Cross-Functional Influence Proven ability to drive outcomes across Legal, Data Science, Engineering,
and Procurement without formal authority
4. Preferred Qualifications
• Certifications: ISO/IEC 42001 Lead Implementer/Auditor (strongly preferred), AIGP (IAPP), CISA, CRISC,
CISM, ISO 27001 Lead Auditor
• Direct experience contributing to or leading an ISO/IEC 42001 certification or readiness effort (not just
familiarity)
• Experience in regulated industries: financial services, insurance, healthcare, or tech/SaaS
• Exposure to MLOps/model inventory tooling from a governance (not engineering) lens
• Prior experience producing regulatory applicability matrices across multiple geographies/frameworks
• Experience working effectively in fully remote, distributed teams
5. Education
• Bachelor''s degree in Information Security, Computer Science, Law, Risk Management, or related field
• Master''s degree preferred, not mandatory