Head of Governance, Risk and Compliance

We are hiring a Head of Governance, Risk and Compliance for our Trust and Intelligence organization a strategic leadership role accountable for establishing governance frameworks, managing enterprise risk, and ensuring regulatory and compliance adherence across the company. You will define how we operate responsibly and compliantly while enabling business growth, and you will lead a growing team across compliance, policy, audit, and emerging technology governance. This includes establishing governance frameworks for agentic AI systems ensuring responsible development, security, transparency and regulatory compliance as autonomous agents become core to our product strategy. 

Role overview 

As Head of Governance, Risk and Compliance, you own the governance, risk and compliance framework across the entire organization. You are accountable for ensuring that Product and Technology, Finance, Operations, Customer Success and all business functions operate in compliance with applicable laws, regulations, contractual obligations, industry standards and internal policies. 

You serve as the central point of accountability for compliance risk, regulatory relationships, audit management, risk governance, policy frameworks, and board-level reporting. This includes establishing governance frameworks for emerging technologies, particularly agentic AI systems, to ensure responsible development, security, transparency, auditability, and regulatory adherence. 

Your mandate is to transform compliance from a reactive, audit-driven function into a proactive, integrated capability that embeds compliance into business processes, enables informed risk-taking, and positions governance as a strategic enabler rather than a constraint. You will work closely with Product and Technology, Finance, Security Operations, Observability, AI/ML teams, Legal, Human Resources, and executive leadership. Success requires balancing rigorous oversight with business enablement, and building cross-functional ownership of compliance responsibilities across the organization. 

Duties and accountabilities 

Regulatory compliance and risk management 

• Maintain current understanding of applicable regulations across all business functions (data protection, privacy, financial, industry-specific, contractual obligations) and monitor regulatory changes to anticipate impact. 

• Conduct regulatory gap assessments, compliance audits and controls testing to identify compliance risks and remediation needs. 

• Develop compliance roadmaps with clear implementation timelines and success criteria for achieving and maintaining regulatory adherence. 

• Manage regulatory relationships and lead audit coordination, audit preparation, and audit response across all regulatory bodies. 

• Establish incident response and breach of notification procedures; lead response to compliance incidents and regulatory violations. 

Enterprise risk governance and assessment 

• Define risk governance frameworks, risk appetite statements and tolerance thresholds aligned with business strategy and stakeholder expectations. 

• Lead enterprise risk assessments across Product, Technology, Finance, Operations and Customer Success to identify strategic, operational, financial, technology and emerging technology risks. 

• Establish risk governance forums with business leaders to review, prioritize and escalate material risks to executive and board leadership. 

• Own risk reporting to Board and executive leadership, with clear risk status, trends and mitigation progress. 

• Drive risk mitigation initiatives and track remediation of identified risks through to closure. 

Policy, governance and control framework 

• Develop, maintain and communicate organizational policies covering data protection, privacy, security, financial, operational and conduct requirements. 

• Establish control frameworks, control standards and control testing procedures aligned with regulatory and business requirements. 

• Define governance forums, decision authority, escalation procedures and approval workflows for compliance-related decisions. 

• Monitor compliance with organizational policies through assessments, audits and exception management. 

• Manage policy exceptions and waivers with clear approval authority, risk assessment and remediation planning. 

Agentic AI and emerging technology governance 

• Establish governance frameworks and development standards for agentic AI systems, including responsible AI principles, transparency and auditability requirements. 

• Monitor emerging AI regulations (EU AI Act, sector-specific AI requirements) and anticipate regulatory impact on agent development roadmaps. 

• Partner with Product and Technology to establish agent security controls, addressing prompt injection, data exposure, unintended behavior and hallucination risks. 

• Define audit and observability requirements for agentic systems, including decision logging, behavior monitoring and explainability standards. 

• Conduct risk assessments of high-risk agent use cases; identify potential harms and mitigation strategies before deployment. 

• Establish agent development gates and approval processes for autonomous agent deployments; maintain emerging technology risk registry. 

Compliance enablement and culture 

• Build compliance capacity across the organization through training, guidance, and compliance support. 

• Partner with Product and Technology to embed compliance and emerging technology governance requirements into product roadmaps and architecture decisions. 

• Provide trusted compliance advice to business leaders on regulatory implications of new products, partnerships, business models, and agent deployments. 

• Drive a compliance culture where ownership is distributed across the organization, not siloed in compliance; position governance as business enablement. 

Regulatory compliance and risk management 

• Maintain current understanding of applicable regulations across all business functions (data protection, privacy, financial, industry-specific, contractual obligations) and monitor regulatory changes to anticipate impact. 

• Conduct regulatory gap assessments, compliance audits and controls testing to identify compliance risks and remediation needs. 

• Develop compliance roadmaps with clear implementation timelines and success criteria for achieving and maintaining regulatory adherence. 

• Manage regulatory relationships and lead audit coordination, audit preparation and audit response across all regulatory bodies. 

• Establish incident response and breach notification procedures; lead response to compliance incidents and regulatory violations. 

Enterprise risk governance and assessment 

• Define risk governance frameworks, risk appetite statements and tolerance thresholds aligned with business strategy and stakeholder expectations. 

• Lead enterprise risk assessments across Product, Technology, Finance, Operations and Customer Success to identify strategic, operational, financial, technology and emerging technology risks. 

• Establish risk governance forums with business leaders to review, prioritize, and escalate material risks to executive and board leadership. 

• Own risk reporting to Board and executive leadership, with clear risk status, trends and mitigation progress. 

• Drive risk mitigation initiatives and track remediation of identified risks through closure. 

Policy, governance and control framework 

• Develop, maintain and communicate organizational policies covering data protection, privacy, security, financial, operational and conduct requirements. 

• Establish control frameworks, control standards, and control testing procedures aligned with regulatory and business requirements. 

• Define governance forums, decision authority, escalation procedures and approval of workflows for compliance-related decisions. 

• Monitor compliance with organizational policies through assessments, audits, and exception management. 

• Manage policy exceptions and waivers with clear approval of authority, risk assessment, and remediation planning. 

Agentic AI and emerging technology governance 

• Establish governance frameworks and development standards for agentic AI systems, including responsible AI principles, transparency and auditability requirements. 

• Monitor emerging AI regulations (EU AI Act, sector-specific AI requirements) and anticipate regulatory impact on agent development roadmaps. 

• Partner with Product and Technology to establish agent security controls, addressing prompt injection, data exposure, unintended behavior and hallucination risks. 

• Define audit and observability requirements for agentic systems, including decision logging, behavior monitoring and explainability standards. 

• Conduct risk assessments of high-risk agent use cases; identify potential harms and mitigation strategies before deployment. 

• Establish agent development gates and approval processes for autonomous agent deployments; maintain emerging technology risk registry. 

Compliance enablement and culture 

• Build compliance capacity across the organization through training, guidance, and compliance support. 

• Partner with Product and Technology to embed compliance and emerging technology governance requirements into product roadmaps and architecture decisions. 

• Provide trusted compliance advice to business leaders on regulatory implications of new products, partnerships, business models, and agent deployments. 

• Drive a compliance culture where ownership is distributed across the organization, not siloed in compliance; position governance as business enablement. 

What success looks like 

• Compliance and regulatory requirements are met through real controls and proactive management, not last-minute scrambles or findings during audits. 
• Risk governance frameworks are transparent, understood, and used by business leaders to make informed decisions about risk and opportunity. 
• Agentic AI systems are governed with clear standards for responsible development, security, transparency and auditability; agents deploy with confidence and customer trust. 
• Compliance ownership is distributed across the organization; business leaders view GRC as a trusted partner and enabler, not a blocker. 
• Business leaders proactively raise compliance and risk questions, rather than waiting for GRC to identify issues. 
• Regulatory and customer confidence is strong; audit results reflect an organization operating with integrity and control.

Department: Research and Development
Function: Engineering
Experience Level: Mid-Senior Level