AI Governance Manager, Lead and Director Roles

Owning how an organization develops and uses AI responsibly: setting AI policy, running risk and impact assessments, overseeing models in production, and answering to regulators and leadership for the technology's behavior.

Most commonly the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act, often together as a single program.

An AI system and use-case inventory, a requirements library holding whichever rules apply to each system, a risk register, a control library, an assessment workflow for new use cases, and an evidence repository. Most organizations put a GRC platform over all of it and wire it into the ticketing system engineering already uses. Naming the vendor matters far less than knowing what belongs in each record and what has to happen when a model, a vendor, or a regulation changes.

Process design before configuration, because automating a confused process only makes the confusion move faster. Then data modeling, platform configuration, permissions, workflow logic, APIs and integrations, reporting and data quality. On top of that, fluency in the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act, and the writing to make all of it survive a legal review.

A use case arrives at intake. Someone classifies it, decides which rules apply, and either clears it or routes it to assessment. The assessment produces risks, the risks pull in controls, the controls carry owners and test dates, and testing produces evidence and findings that close on a clock. Then it repeats, because the model changed, the vendor changed, or the law did. Designing that loop, and deciding which steps stay human, is the job.

Build one workflow and show it. Take use-case intake or control testing, define the records, required fields, roles, states, approvals, notifications, service levels, evidence, exceptions, reports and change controls, then explain which decisions you deliberately left with a human. That single artifact answers more of an interview than a certificate does.