GRC Careers: Governance, Risk and Compliance JobsGovernance · Risk · Compliance Careers

Why these companies exist, and what happens if I don't

A note from the founder. Not that I plan on going anywhere, but what we say speaks for itself.


September 1, 1999. That is when ExecSearches opened.

Since that day it has done one thing: place mission-driven professionals into impact organizations. Nonprofits, hospitals, universities, foundations. There, the client is the institution, and you strengthen the civic infrastructure by helping those organizations staff themselves.

I run two companies now, and the difference between them explains everything about the second one.

At every level, which is the part I would want understood. Chief executives, yes. Also program directors, development officers, finance managers, and the administrative assistant to the executive director, which is one of the most important positions in any organization and is routinely treated as though it were not. That person controls the calendar, and the calendar decides what the organization pays attention to. They are the first voice a board member or a major donor hears. They see everything. A mission runs on them.

And every one of those hires is a decision about the future, rather than a vacancy being filled. The program director placed this year is running the organization in fifteen. The assistant who learns the sector from that desk becomes the development director, then the executive. Whoever goes into the seat today is who the sector gets led by later. You are always building the future, whether or not you are paying attention to it.

AI Governance Jobs runs that same idea backwards. The employers posting here are banks, retailers, hospitals, agencies, defense contractors and AI companies. Most of them are not civic organizations and never will be. They are simply where the work happens. **Here the people in the jobs are the point, and they get served no matter whose building they are standing in.**

To be plain about something, since I have been asked: ExecSearches is not going anywhere. It is still doing what it has done since 1999, and that work is still the work. The second company is not a replacement for the first one. It exists because of it.

ExecSearches is in the middle of an upgrade right now, and the new platform is days away. That is an odd thing to spend money and months on if you are walking away from something. The investment is going into it rather than out of it.

And the site is working normally in the meantime. Jobs are posting, applications are going through, nothing is paused and nothing is waiting on the rebuild. If you are hiring this week, hire this week.

The hospital ExecSearches finds a chief executive for now has an algorithm deciding how patients get triaged. The university needs somebody who understands what the law requires before it buys an admissions tool. The foundation is being asked to fund programs that run on models nobody in the building can explain. Those organizations have come to me for their people since 1999, and the leadership they need today includes a job title that did not exist when I started. Somebody has to find those people, and it should be somebody who already understands the institutions.

So the two boards serve the same organizations from two directions. One finds the people who run them. The other finds the people who keep what they deploy from hurting anybody.

They also share candidates, which matters more than it sounds. A lot of the people on the mission-driven board are already doing this work without the title. If you have managed grant compliance, handled patient information at a community health center, dealt with student records at a university, or been the person who reads the contract before anyone signs it, you have been doing governance, risk and compliance for years. Nobody called it that.

Some of these jobs are technical and some are not, and the difference matters to you.

A real share of this field wants engineering or quantitative skill. Model validation, AI security, testing systems for bias, building the monitoring. If a posting is asking for that, it is asking for that, and I am not going to tell you otherwise.

The rest of the field runs on judgment about rules and institutions. Policy, privacy, compliance program work, audit, regulatory analysis, governance. Writing the standard, deciding what evidence counts, sitting in the room when somebody wants to deploy something and asking what happens to the person it gets wrong. That half is large, it is growing faster than the technical half, and it does not require you to write code.

So read the posting rather than ruling yourself out from the category. What it asks for is usually plain on the page. A lot of people who could do the second kind of job never apply because they assumed the whole field was the first kind.

And these jobs pay more. I am not going to pretend that is a small thing to someone who has spent a decade underpaid for doing work that mattered. Moving across is a real option, and I would rather you heard it from me than kept assuming the door was closed.

It serves the mission twice. The person gets a career with a ceiling. And the people ending up in charge of governing these systems are then people who spent years thinking about who gets harmed when an institution gets it wrong. I would take that background over a purely technical one every time.

What they have in common is the only thing that matters. Both exist to put a capable, honest person into a seat where the public is affected by whether they do the job well. Both are reviewed by hand rather than run on volume. Both refuse to make anything up. And both come out of the same idea from 1982: that the institutions holding a society together are only as good as the people inside them.

The rest of this is about the newer board, because it is the one people do not understand yet.

The people this is for

Somebody at a hospital is the reason your medical records were not sold.

Somebody at a bank is the reason a lending model got tested for bias before it went live, instead of after a regulator asked.

Somebody at a clothing company is the reason a sixteen year old's data stayed where it belonged, and the reason a supplier got dropped for using child labor.

Somebody inside an agency is the reason an automated system did not quietly cut off the benefits of people who had no idea a model was involved.

You will never learn any of their names. Their job is to say no to their own employer, which makes them the least popular person in the building on the days they do it well. Most of them are called something forgettable. Compliance analyst. Privacy officer. Internal auditor. AI governance lead.

**They are the reason the public is protected from institutions the public cannot audit, cannot question, and has no realistic choice about dealing with.**

This job board exists for them.

What changed

AI is now making decisions about people. Who gets the apartment. Who gets flagged for review. Who gets the second interview. How a claim gets handled. How a patient gets triaged. Nobody voted on that. It happened, deployment by deployment, while the rules were still being written.

So the apparatus that protects people from institutional power is now partly made of software, and the only thing standing between a model and a person it is about to get wrong is a human being with the authority to stop it.

Those seats are mostly empty. That is the problem we work on.

What we actually believe about AI

We are not here to slow this technology down. We think it can do an enormous amount of good, and the sooner it is trusted the sooner people get that good.

But a frightened public does not adopt a technology. It blocks it, or it accepts it badly and gets hurt, which produces more fear and harder blocks. Every genuinely useful thing AI could do for a hospital, a school district or a benefits agency is waiting on one thing: whether people believe somebody competent is accountable for it.

**Guardrails are not a tax on this technology. They are the price of admission, and they are cheap at that price.**

And the fear is pointed slightly wrong. People talk about the machine as though the machine decided. It did not. Someone chose to deploy it without testing. Someone chose to screen tenants with it. Someone chose to let it make a call nobody had authorized it to make. The accountable party is always a person, and the work is making sure that person exists, has standing, and can be found.

Which is why rules that audit software and stop there do not work, and rules that put a named human in the path of a decision do.

The place you have already met this, whether anyone told you or not

Hiring.

There is a decent chance an algorithm has already rejected you. A parser read your résumé and scored it. A ranking model decided which twelve applications a human would actually see. A system scanned a recorded interview and rated your enthusiasm. Most people this has happened to were never told, and the rejection email said the position had been filled.

When that goes wrong, people call it AI bias. It is not the algorithm's bias. It is somebody's.

A person chose the training data, which was the company's own past hiring, so the model learned who the company used to hire. A person picked a proxy that correlated with race or age or disability without checking, like the distance of a commute or a gap in employment. A person decided an audit was too expensive. A person signed off on deploying it. Every one of those was a human decision made in a meeting, and the machine carried out instructions it was given.

So this is the clearest case of the whole argument. The technology did what it was built to do. The harm came from the choices around it, and from nobody in the room having the standing to say no.

So we made it a condition of posting here

Every organization publishing a job on this board certifies to our Recruitment and Hiring Code of Conduct. Direct employers, search firms, agencies, all of them. The short version:

They have to tell you if a machine is screening you. A human keeps the final say, with no automated rejection without human review. Your résumé is never training data, and it cannot be sold, rented or handed to a broker. A salary range is required whether or not the law demands one. And where bias audits are the law, they certify the audits were done.

The full text is here, and it is worth five minutes of your time if a job has ever rejected you without explanation: https://www.ai-governance-jobs.com/code-of-conduct/

And this board does no ranking of its own

Worth being plain about, because the opposite would make us money.

We do not algorithmically rank, score or filter candidates. No model decides which applicants an employer sees first. No score is attached to your name. Every job here is reviewed by a person, and nothing hidden sorts you.

We hold employers to a standard on automated hiring. Hard to do that while running the same machinery ourselves.

Where this is going

Electricity used to be whatever the man who showed up sold you. Now it has safety codes, licensed electricians, inspections, and a duty to keep the power on.

In the places where retail electricity was deregulated, it does get marketed, relentlessly. A dozen companies want to sell you a plan this week.

Look closely at what they compete on. Same grid, same generation, same electrons, and often the same parent company behind two brand names. What differs is the billing. One says nights are free. Another says weekends are free, provided you do not run the dryer between four and seven. A third is cheap until you cross a usage line nobody explained. Nobody is selling better electricity, because there is no better electricity. They are selling pricing schemes, and the complexity is the product.

Meanwhile nobody offers you a choice about whether the wiring in your house gets inspected. That part is settled, mandatory and identical for everyone. It is also the part that decides whether the house burns down.

That is the lesson, and it argues against leaving this to the market. Competition went to the billing layer, because that is where the money was. The safety layer got no competitive pressure at all. It had to be required. And where that required layer was left thin, people have died for it.

So the shape AI needs is companies competing hard on the product, over a floor nobody gets to opt out of. If we wait for the market to compete on trustworthiness, we will get what we got here: a dozen brands, one underlying thing, and a lot of clever pricing.

The people filling these jobs today are the inspectors of a utility that has not been declared one yet. In twenty years they will be the regulators, the standard writers, and the person whose signature means a system was checked. Some of them have not started yet. Some of them are deciding right now whether they can afford to try.

Which is why our study material is free. No account, no email required, nothing to buy. Not as a promotion. Because if the only people who can enter this profession are the ones who can pay two thousand dollars for a certification, then the people who write the rules will all come from the same place, carry the same blind spots, and will tolerate exactly the harms they have never personally experienced. The people with the least protection would have nobody in the room who has ever been on the receiving end of any of this.

Who gets into this work decides what this work will tolerate. That is worth more than our tuition revenue.

What we will not do

Looking for work is one of the most exposed things a person does. You have to tell strangers what you earn, what you can do, and that you need something. Plenty of companies have noticed how profitable that exposure can be.

So, plainly:

We do not sell, broker, rent or share your information. Not to recruiters, not to advertisers, not to data partners, not to anyone. There is no arrangement, and there will not be one.

We do not require an account to use the tools. Read the guides, take the practice questions, use the résumé review. No sign-up wall.

We do not track what you looked at. No analytics, no advertising pixels, no third-party scripts watching you read. If you open a page here, your browser talks to us and to nobody else. Someone quietly checking whether they could leave the employer who is pressuring them should be able to do that without it being recorded anywhere, including here.

We check listings against the employer's own system and take down what has closed. Not once at posting, continuously. Anything we cannot confirm is live stays off the front page, and anything we find closed comes off the board. We will not claim perfection here, because a requisition can close an hour after we check it. What we will claim is that we look, we keep looking, and we act on what we find.

An expired posting wastes the time of someone who has very little of it to spare, and worse, it tells them they were not good enough when the truth is the job was gone before they opened the page.

We do not invent salary numbers. Where a range is shown, it came from the employer or from a published source we will name. Somebody is deciding whether they can afford to take a mission job on the strength of that number.

We are aware that some of the above would make us more money if we abandoned it. That is the point of saying it in public.

The Kill Switch

A promise is worth very little on its own, so here is what sits behind the ones above.

Every company writes paragraphs like those. Some of them mean it at the time. Then a funding round happens, or an acquisition, or a bad quarter, and the wording changes quietly in a document nobody reads. The people who made the promise are rarely the people who break it.

So this company is built to be ended. There is a mechanism for it and it has a name, because euphemism is how these things get softened later. We call it the Kill Switch.

If this business ever becomes the thing it exists to oppose, by trapping the people it claims to serve, by selling their information, or by being absorbed into an operation that does, then the instruction is that it gets shut down. Not reformed, not rebranded, not sold on to somebody who will run it differently.

That authority does not sit with whoever happens to own it at the time, because that is precisely the person it needs to be used against. It sits outside the company, with people who have known the founder for decades and understand what this was built for. It is written into the arrangements governing what happens if he dies or is incapacitated for any length of time. Nobody can buy that authority, and nobody inside here can vote it away.

The mechanism has been thought through, and here is the shape of it. The hard part of a promise like this is not the willingness. It is noticing. A company that has drifted into harming people rarely announces it, and the people inside are the last to see it, because they have explanations for everything.

So the design does not rely on anyone here deciding to look. A signal watches how this business is actually regarded, and if it reaches the point where the market reads us as having become the thing we exist to oppose, a request goes to the designated holders asking them to consider pressing the Kill Switch.

The signal does not get to decide. It raises the question. A human who understands what this was for answers it. That split is deliberate. An automatic trigger could be gamed by anyone with an interest in seeing this shut down, and a purely human process can be talked out of acting. Requiring both means neither a bad actor nor our own excuses can stop the question from being asked.

We would rather this disappear than continue in a form that harms the people it was supposed to protect. That is the commitment behind the rest of it, and it is why we are willing to put the rest of it in writing.

Ask Indeed if they do.

What we are

Since 1999 this has been one job: putting mission-driven professionals, from the assistant at the executive's desk through the chief executive, into impact organizations. This board is that same work, aimed at a newer part of the same infrastructure.

The difference is who the client is. On the mission-driven board, the client is the institution. Here, the people in the jobs are the point, and the employers are simply where the work happens. A seat earns its place here by what it does, not by whose logo is on it. Governing the technology belongs on this board whether that seat sits in a government agency, a hospital, a bank, a retailer or an AI lab. Building or selling the technology is somebody else's job board.

We are a mission-driven organization. Not a company that serves them. One of them.

When we are finished

When these positions are filled. All of them, everywhere. The harm crosses borders and so does the law, so a profession staffed in one country leaves most of the work undone.

We will not get past this phase until that happens. Getting past it is the whole job.

We will not be finished until these positions are filled, everywhere in the world.

Nous n'aurons pas terminé tant que ces postes ne seront pas pourvus, partout dans le monde.

No habremos terminado hasta que estos puestos estén cubiertos, en todo el mundo.

F. Jay Hall, Founder
GRC Careers · ExecSearches