# AI Risk & Compliance Analyst

**Company:** [WHOOP](https://hotfix.jobs/companies/whoop)
**Location:** Boston, MA
**Role:** Other
**Experience:** 6+ years
**Skills:** ai risk assessment, GRC, nist ai rmf, iso 42001, eu ai act, GDPR, third-party risk management, llm security, ai governance, vendor risk assessment, compliance auditing, risk reporting
**Posted:** 2026-07-17

> Lead day-to-day AI governance, risk assessments, and compliance for AI/ML systems, LLMs, and vendors at WHOOP. Requires 6+ years GRC experience with demonstrated AI risk assessment background and familiarity with NIST, ISO, and EU AI Act frameworks.

## Job Description

## Responsibilities
- Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows.
- Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into GRC frameworks and translate technical risk into governance requirements.
- Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks, including ISO/IEC 42001, NIST Cybersecurity Framework, NIST AI Risk Management Framework, EU AI Act, GDPR, and other applicable standards.
- Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring, control mapping, and remediation tracking.
- Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls, evidence collection, and follow-up on remediation items.
- Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external compliance reviews involving AI systems.
- Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains, explainability requirements, and compliance obligations.
- Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend analysis, control effectiveness measurements, and key metrics.
- Monitor emerging AI governance requirements, guidance, and best practices, translating them into GRC program updates and compliance recommendations.
- Support security incident documentation and post-incident analysis for AI system events, coordinating with Legal and Security teams to ensure appropriate governance response.

## Qualifications
- 6+ years of experience in Governance, Risk & Compliance, including risk assessment, policy development, audit coordination, and third-party risk management.
- Demonstrated experience performing governance or risk assessments for AI/ML systems, including LLM integrations, model pipelines, AI agents, or data-driven algorithmic systems.
- Experience translating AI-specific risks (i.e., data poisoning, prompt injection, model misuse, data leakage, explainability gaps) into documented control requirements and governance standards.
- Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or machine learning service providers.
- Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, GDPR, PCI DSS, or similar standards.
- Strong understanding of data governance concepts relevant to AI systems, including training data lineage, data retention, model output handling, and human oversight requirements.
- Experience supporting regulatory readiness or compliance efforts related to AI systems.
- Proven ability to collaborate with engineering and security teams to validate control implementation and remediation.
- Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field.

## Similar roles

- [Detection and Enforcement Program Manager](https://hotfix.jobs/jobs/471e1e46-0411-48dd-9883-cd500272a2e5) - Discord - San Francisco, CA - $160k – $180k/yr
- [AI & Automation Lead, Customer Operations](https://hotfix.jobs/jobs/0c15619f-ad78-4d5f-aa8c-28b2f4a4c629) - AlertMedia - Austin, TX
- [Compliance Operations Lead](https://hotfix.jobs/jobs/8e5c2d02-1665-4048-9836-26e93ebd2ab3) - Govsignals - New York, NY - $140k – $190k/yr
- [AI Accelerator Lead](https://hotfix.jobs/jobs/d9a2ddc1-a24a-4177-b5d0-133649b62a68) - Vercel - Remote - $114k – $172k/yr
- [Mine Planner](https://hotfix.jobs/jobs/a8664fb7-ff55-41c8-a1e1-4985026efdfb) - Mariana Minerals - San Francisco, CA - $140k – $175k/yr

**Apply:** https://hotfix.jobs/jobs/8cd869b6-8f0f-4577-8fc8-e422d2ddf1f9
**Canonical:** https://hotfix.jobs/jobs/8cd869b6-8f0f-4577-8fc8-e422d2ddf1f9