Principal – Technology Risk and Control – Artificial Intelligence & Cloud Risk

Tasks

Define enterprise-wide risk taxonomy and tiering, aligned with use case criticality, autonomy, data sensitivity, customer impact, and systemic exposure.

• Establish clear risk-control linkages to support consistent decisions and auditable governance.
• Define minimum control requirements for AI and cloud services and act as an authorized interpreter of AI and cloud risk standards.

AI & Cloud Risk Assessment

Collaborate on the development of the enterprise AI and cloud risk assessment methodology to ensure it is risk-based, proportionate, repeatable, and auditable.

• Collaborate with AI architecture and model risk teams to assess inherent and residual risks, including model behavior, bias, explainability, data risk, security, resilience, and autonomy.
• Integrate risk assessment throughout the entire AI lifecycle and into cloud onboarding and architecture decisions to ensure that outcomes inform risk approval and exception reporting.

Control design and effectiveness

Set expectations for the design of AI and cloud controls to ensure that controls are integrated from the outset and aligned with preventive, detective, and corrective principles.

• Define standards for human oversight, monitoring, logging, explainability, and evidence.
• Collaborate with risk and security teams to assess the effectiveness of controls and address systemic gaps.

Regulatory alignment and consulting

Ensuring alignment with internal standards, model risk governance, and emerging AI regulatory requirements.

• Translation of regulatory requirements into practical, implementable controls for front lines.
• Acting as a trusted risk advisor and challenger to senior technology, cloud, architecture, and AI executives, providing definitive risk recommendations for high-value AI initiatives.

Enablement and maturity

Develop playbooks and guidelines to scale consistent AI and cloud risk practices.

• Coaching risk and technology partners to improve corporate risk awareness.
• Further development of AI governance maturity, including automation and integration with modern engineering practices.

Requirements

15+ years of experience in technology risk, cyber risk, model risk, cloud risk, or related disciplines, with demonstrable enterprise-wide responsibility.

• Proven success in designing and owning enterprise-wide risk and control frameworks.
• Deep exposure to AI systems, cloud platforms, and complex digital architectures in regulated environments.
• Professional certifications such as CISP, CCSK, CRISC, or equivalent (preferred but not mandatory).