Sr Manager, Emerging Technology Risk

Accountabilities

• Specialized-level role that requires depth and/or breadth of expertise in own discipline.

Key Responsibilities

• Support the implementation and ongoing maintenance of BMSs AI governance framework, including archetype-based control models covering risk classification, control objectives, implementation patterns, and acceptable evidence standards.
• Conduct structured risk assessments of AI and GenAI tools being considered for enterprise adoption, evaluating each against BMSs risk appetite, security standards, and regulatory obligations prior to deployment approval.
• Execute AI risk and conformity assessments aligned to EU AI Act, NIST AI RMF, ISO/IEC 42001, and applicable global privacy regulations (GDPR, EDPB, state-level AI laws), including risk classification for use cases across Clinical, Commercial, and RD domains.
• Assess GenAI tools and LLM deployments - including Claude (via AWS Bedrock), ChatGPT, and other third-party services - for data privacy, contractual, and data residency implications; document findings and escalate issues as appropriate.
• Partner with business and technology stakeholders to document and track controls for approved AI technologies, ensuring controls are practical, embedded in workflows, and aligned to identified risks.
• Execute control testing activities for AI-specific controls, including pre-deployment validation, post-deployment effectiveness testing, and periodic re-assessments; document results, gaps, and remediation plans and track findings through to closure.
• Maintain GRC platform records (ServiceNow, OneTrust) for AI risk assessments, control testing results, and issue tracking, ensuring data quality and audit readiness at all times.
• Prepare risk assessment summaries, control testing reports, and governance dashboards to support leadership reporting and stakeholder communications.
• Monitor the evolving AI regulatory landscape - including EU AI Act developments, NIST updates, and emerging state-level AI laws - and summarize implications for BMS programs.
• Support the tracking and assessment of risks from next-generation AI capabilities including agentic AI, multi-modal GenAI, synthetic data pipelines, and quantum-accelerated inference.

Education

• Bachelor's degree required in information security, computer science, risk management, data science, or a related field.

Experience

Required

• 8-10 years of progressive experience in GRC, information security, or technology risk, with at least 1-2 years directly focused on AI, emerging technology, or data governance.
• Hands-on experience executing GRC control assessments or technology risk reviews in a large, complex enterprise environment.
• Working knowledge of AI governance frameworks: NIST AI RMF, EU AI Act, and/or ISO/IEC 42001 or 23894.
• Familiarity with LLM/GenAI risk concepts including prompt injection, hallucination risk, IP leakage, and training data privacy.
• Understanding of cloud-based AI deployment architectures and data residency/privacy implications of BMS-controlled vs. third-party SaaS environments.
• Strong analytical, documentation, and communication skills with the ability to translate technical risk findings into clear, actionable outputs.
• Ability to work effectively in a global, cross-timezone environment with onshore and offshore teams.

Preferred

• Experience in Life Sciences, Pharma, or a highly regulated industry (FDA oversight, GxP, clinical data governance).
• Exposure to AI gateway architecture, API security controls, and control plane governance.
• Familiarity with agentic AI systems, model cards, data lineage frameworks, and model lifecycle governance.
• Experience with GRC platform tooling (ServiceNow, OneTrust).

Certifications

• GARP RAI (Responsible AI) Certificate
• CISA or Security+ (for broader security context)