Job Description:

Experience Required:

- 8-10 years of experience in security, risk, or governance roles, including at least 3 years focused specifically on AI/ML governance, responsible AI, or model risk management.

Key Responsibilities:

1. Entitlements & Access Control:

- Define and enforce entitlement and access-control policies across all platform capabilities, ensuring data and model access are never granted beyond what a user's role permits.

2. Audit Trail Design:

- Own the audit trail design so that every routing decision, model call, and human action is logged, reviewable, and reproducible.

3. Evaluation Harness:

- Design and maintain the evaluation harness used to test AI outputs for accuracy, bias, safety, and policy compliance before and after release.

4. Responsible-AI Reviews:

- Lead responsible-AI reviews for new capabilities, agents, or model changes prior to production rollout.

5. AI Guardrails:

- Establish and monitor guardrails against prompt injection, data exfiltration, unsafe tool use, and other AI-specific risks.

6. Data Classification & Privacy:

- Define data classification, redaction, and privacy-by-design requirements (e.g., PII/PHI handling) in partnership with legal and compliance stakeholders.

7. Model Change Management:

- Own model versioning, rollback, and change-management policy so that any production issue can be traced and reversed.

8. Audit & Compliance Liaison:

- Serve as the primary point of contact for internal and external audits, security reviews, and compliance questions related to the platform.

9. Governance by Design:

- Partner with solution architects and engineering leads to ensure governance requirements are reflected in system design, not retrofitted after build.

Qualifications:

- Demonstrated experience building or governing AI/ML systems in a regulated or high-compliance environment.

- Strong understanding of access control models (role-based, attribute-based) and entitlement enforcement patterns.

- Familiarity with AI safety and evaluation frameworks, including bias, groundedness, and adversarial-robustness testing.

- Experience with audit logging, data lineage, and reproducibility requirements.

- Working knowledge of data privacy regulations and privacy-by-design principles.

- Strong stakeholder communication skills - able to translate technical risk into business-relevant terms for leadership and auditors.

- Experience in pharmaceutical, healthcare, or other highly regulated industries.