AI Risk & Compliance Analyst

Responsibilities

• Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows.
• Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into GRC frameworks and translate technical risk into governance requirements.
• Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks, including ISO/IEC 42001, NIST Cybersecurity Framework, NIST AI Risk Management Framework, EU AI Act, GDPR, and other applicable standards.
• Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring, control mapping, and remediation tracking.
• Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls, evidence collection, and follow-up on remediation items.
• Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external compliance reviews involving AI systems.
• Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains, explainability requirements, and compliance obligations.
• Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend analysis, control effectiveness measurements, and key metrics.
• Monitor emerging AI governance requirements, guidance, and best practices, translating them into GRC program updates and compliance recommendations.
• Support security incident documentation and post-incident analysis for AI system events, coordinating with Legal and Security teams to ensure appropriate governance response.

Qualifications

• 6+ years of experience in Governance, Risk & Compliance, including risk assessment, policy development, audit coordination, and third-party risk management.
• Demonstrated experience performing governance or risk assessments for AI/ML systems, including LLM integrations, model pipelines, AI agents, or data-driven algorithmic systems.
• Experience translating AI-specific risks (i.e., data poisoning, prompt injection, model misuse, data leakage, explainability gaps) into documented control requirements and governance standards.
• Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or machine learning service providers.
• Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, GDPR, PCI DSS, or similar standards.
• Strong understanding of data governance concepts relevant to AI systems, including training data lineage, data retention, model output handling, and human oversight requirements.
• Experience supporting regulatory readiness or compliance efforts related to AI systems.
• Proven ability to collaborate with engineering and security teams to validate control implementation and remediation.
• Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field.