The AI Governance & Risk Analyst keeps each client's Managed AI program current, usable, and defensible as tools and risks change. You'll turn usage and vendor signals into decisions, maintain the operating records behind those decisions, guide users toward approved practices, and coordinate the governance side of AI incidents.
Responsibilities:
- Establish and maintain each client's AI inventory, sanctioned-tool list, Acceptable Use Policy, exception records, and vendor-onboarding workflow
- Analyze DNS-layer shadow AI and Microsoft 365 usage signals, investigate material changes, and produce the monthly AI Usage Report
- Review AI vendors for data access, retention, contractual, security, and material-change risks before approval and throughout the relationship
- Maintain DPA and BAA inventories where applicable, including owners, status, renewal dates, approved data scope, and unresolved gaps
- Run recurring policy, tool, and risk reviews; document decisions, assign remediation, and track open actions to closure
- Package clear evidence and executive summaries for client leadership, insurance, audit, and governance reviews
- Support role-based AI training and manager communications so approved tools, prohibited uses, and escalation paths become operating behavior
- Coordinate AI-specific incident response, including triage, evidence collection, stakeholder communication, follow-up actions, and policy or control updates
Qualifications:
- 3+ years in IT governance, security GRC, or comparable risk-analysis role
- Strong written communication and policy-drafting discipline
- Familiarity with regulatory frameworks (HIPAA, SOC 2, NIST CSF, NIST AI RMF, ISO 42001)
- Comfortable with technical security data (DNS logs, M365 audit, SIEM extracts)
- Eligible to work in the U.S.