AI Governance - Associate / Senior Associate

Key Responsibilities

• Establish AI Governance Frameworks: Develop, implement, and maintain the companys AI Governance framework, aligning with emerging industry standards (e.g., NIST AI RMF, ISO 42001, EU AI Act).
• Control Integration & Mapping: Adapt traditional IT General Controls (ITGC), IT Application Controls (ITAC), and Internal Controls to apply effectively to AI and Machine Learning models.
• Risk Control Matrix (RCM) Development: Design, update, and manage the Risk Control Matrix (RCM) to capture risks associated with AI deployment, automated decision-making, and financial reporting impacts.
• Compliance Assurance (SOX & SOC): Collaborate with internal and external audit teams to ensure AI systems impacting financial reporting are fully compliant with SOX (Sarbanes-Oxley) and meet SOC 1 / SOC 2 trust criteria.
• Control Testing & Auditing: Execute rigorous control testing for both business process controls and financial controls executed or influenced by AI technologies.
• Third-Party Risk Management (TPRM): Conduct security and compliance risk assessments on third-party AI tools, vendors, and integrations as part of our TPRM program.
• Cybersecurity & Data Privacy: Partner with the Cybersecurity and data protection teams to ensure AI models comply with data security policies, protecting intellectual property and sensitive user data.
• Advisory & Collaboration: Act as a trusted advisor to data science, engineering, and business units, translating complex regulatory requirements into actionable control designs.

Qualifications & Experience

Required:

• Experience: 2+ years of experience in IT Audit, IT Risk Management, cybersecurity compliance, or internal controls.
• Core Compliance Expertise: Strong hands-on experience with ITGC, SOX, SOC (1/2/3), IT Application Controls (ITAC), and general internal controls frameworks.
• AI/Emerging Tech Governance: Demonstrated exposure to or foundational knowledge of AI Governance, algorithmic auditing, or managing risk in automated decision-making pipelines.
• Risk Management Frameworks: Proven ability to build and test a Risk Control Matrix (RCM), bridging financial controls and business process controls.
• TPRM & Security: Solid understanding of Third-Party Risk Management (TPRM) and fundamental Cybersecurity principles.
• Education: Bachelor’s degree in Management Information Systems (MIS), Computer Science, Accounting, Finance, Risk Management, or a related field.