AI Auditor

GRC Careers is building a shortlist of AI auditors for client search work, and we are talking to candidates now. This is an open, ongoing search rather than a single requisition, so if your background fits we want to know you before the next mandate opens rather than after.

AI audit is where internal audit, model risk and AI governance meet. The work is testing whether an organization's AI systems actually do what its policies claim: whether the inventory is complete, whether the risk classification holds up, whether human oversight is real rather than documented, whether the evidence would survive a regulator or a certification body. It is judgment work with a paper trail, and demand for it is running well ahead of supply.

The organizations hiring for it are the ones that have moved past writing an AI policy and now have to prove the policy operates. That means financial services, healthcare, technology, higher education, government and the larger nonprofits, and it increasingly means work scoped against ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act rather than against a general controls checklist.

How this works: you apply to us, not to an employer. F. Jay Hall reviews every application personally and speaks with the candidates he thinks are a fit. Nothing is forwarded to a client without your say-so, and we tell you which organization it is before we send anything. We have run executive search since 1998, so we know what a real conversation is worth and what a resume blast is worth.

If you are exploring rather than looking, that is a fine reason to be in touch. Much of this market never reaches a public job board.

Qualifications

• Experience auditing, assessing or independently reviewing AI or machine learning systems, or internal audit and model risk experience you are moving into AI assurance.
• Working knowledge of at least one AI governance framework: ISO/IEC 42001, the NIST AI Risk Management Framework, or the EU AI Act's conformity assessment and high-risk requirements.
• The ability to test a control rather than read a policy: sampling, evidence gathering, workpapers, and defensible conclusions.
• Comfort with the technical surface of AI systems, including training data lineage, model documentation, evaluation results, bias and fairness testing, and monitoring in production. You do not need to build models.
• Clear written findings. Most of the value of an audit is whether an executive can act on the report.
• Certification is welcome but not required. CISA, CIA, AIGP, CRISC, ISO 42001 lead auditor and equivalent experience all read well here.
• Consulting, fractional and full-time candidates are all in scope. Tell us which you want.