AI Governance SME

Key responsibilities

• Enact the framework drafted by Risk & CISO as published, self-serve guardrails and patterns — placed where makers actually work. Communicate and evangelize AI Governance policy across the client workforce.
• Support engineers in executing the risk ladder: score each use case once (reversibility, real-world impact, regulatory exposure, auditability) so risk tier decides architecture, testing depth, oversight level, and operational monitoring intensity.
• Lead the thinking on the control plane programme: define what good looks like, shape requirements across the IT-led and citizen-led estates, steer the buy/build/extend evaluation and selection, set the policies to enforce first, and stay the design authority through delivery and hand-off into operations.
• Champion data governance for AI data: work with the client’s existing data governance function so the data that is valuable to AI use cases — client data and knowledge included — is supported through their team, within their governance, catalogue, and quality systems.
• Run the single review path for novel or high-risk work (new data sources, client data, autonomous agents) jointly with Risk & CISO — every approval becomes a reusable pattern. Maintain guardrails, patterns, and best practices library.
• Keep the risk register (models and agents in use) and the firm-wide AI use case register current.
• Work with the client’s existing risk & compliance team to shift AI Governance policies and processes.

Technical skills & experience

• AI governance — frameworks, controls, and operating standards, designed for self-service rather than gatekeeping; recognised as a voice worth following on the subject.
• AI security and evaluation depth: prompt injection, jailbreaks, tool misuse; baseline threat evals for agentic systems.
• Risk & compliance: ISO 42001, NIST AI RMF, GDPR, and EU AI Act compliance.
• Data governance fluency: classification, cataloguing, quality, and access management — enough to partner credibly with a data office.
• Technology selection judgement: shaping requirements, evaluating vendor and build options, and setting enforcement priorities — with policy-as-code and automation as the mechanism.
• Control plane / AI runtime governance tooling: agent identity, real-time policy enforcement, replayable audit, FinOps, and shadow-AI discovery.
• Experience embedding governance in a regulated professional-services or similarly complex environment, alongside both pro-code engineering teams and citizen developers.

Soft skills — how this role succeeds

• Communication that lands at every level: explaining risk tiers to a maker in a clinic, evidence readiness to Q&R, and direction to executive sponsors — plainly, without jargon.
• Collaboration over control: this role works inside other people’s teams (Risk, CISO, Q&R, the data office, engineering, platform admins) and wins by making their jobs easier, never by marking their homework — including partnering well with the PM.
• Facilitation and influence: chairing reviews and workshops, building consensus between risk-cautious and delivery-hungry stakeholders, turning pushback into requirements.
• Pragmatic judgement: knowing when a rule protects and when it stifles — comfortable saying yes safely, and saying no with an alternative.
• Empathy for the sceptic: treating concerns as assets, answering each with evidence in the stakeholder’s own workflow.

Working relationships

Reports into the AI Architect and a client-side co-lead. Works day-to-day with risk & compliance and CISO functions (framework owners), quality & risk teams, data governance functions (as champion for AI data), AI guardrails and best-practice engineers (patterns library), AI operations and monitoring leads (monitoring and audit hand-off), and platform administration teams (DLP and environment alignment).