AI Governance & GRC Compliance Lead

BULL-IT SOLUTIONS LTD; Polska; Presencial; PLN 180 000 - 260 000; Tempo integral

Resumo da oferta

BULL-IT SOLUTIONS LTD is seeking a Compliance Analyst to support its Security, Compliance, Privacy, AI Governance, Third-Party Risk, and Service Delivery functions within its GRC program.

This role focuses on maintaining and obtaining compliance with key frameworks and certifications (ISO 27001, ISO 42001, ISO 27701, SOC2, HITRUST) while driving TPRM activities and supporting audits across enterprise AI platforms.

Qualificações

• 4+ years in risk, compliance, or audit roles.
• 5+ years total IT/security/operational risk experience in enterprise AI platforms.
• CRISC certification required.
• Familiarity with GDPR, UK GDPR, US privacy laws and AI governance frameworks.

Responsabilidades

• Assess and communicate risk in providing compliance guidance to the business.
• Coordinate audits and assessments (PIA, DPIA, TIA, AI impact) and maintain risk registers.
• Review AI intake forms and model cards for completeness and accuracy.
• Support audits related to ISO 42001, ISO 27701, HITRUST and other certifications.
• Lead Third-Party Risk Management activities and vendor assessments.
• Collaborate with Security, Privacy, and AI Governance teams to close audit findings.
• Maintain and improve GRC frameworks, policies, and procedures.

Conhecimentos

GRC policies

Audit management

AI governance

CRISC

OneTrust

GDPR knowledge

Formação académica

Bachelor’s degree in Information Security

Ferramentas

OneTrust

Descrição da oferta de emprego

About The Role We are looking for a Compliance Analyst to support our Security, Compliance, Privacy, AI Governance, Third-Party Risk, and Service Delivery functions within CLIENT Technology’s GRC program. This role focuses on maintaining and obtaining compliance with key frameworks and certifications such as ISO 27001, ISO 42001, ISO 27701, SOC2 and HITRUST, while also driving Third-Party Risk Management (TPRM) activities and supporting internal and external audits.

The ideal candidate will have:

• Experience creating and implementing GRC policies, addendums, documentation and site content.

• Experience in leading or actively supporting audits and certifications against one or more of ISO 27001, ISO 42001, ISO 27701, SOC2, HITRUST at the enterprise level

• Passion for AI ethics, GRC, security, data protection and privacy.

• Required Certification: CRISC (Certified in Risk and Information Systems Control)

• Bachelor’s degree in Information Security, Compliance, or a related discipline.

• 4 + years of experience in risk, compliance, or audit roles (preferably within security or privacy domains).

• 5+ years of total applicable work experience with at least 4 of those years in information technology, information security and/or operational risk management in the context of enterprise AI platforms, including managed services across hyperscaler & hybrid cloud environments.

• Working knowledge of GRC frameworks (ISO, NIST, SOC 2) and risk management practices.

• Working knowledge of data protection laws (GDPR, UK GDPR and US state privacy laws) and AI governance frameworks (EU AI Act, ISO 42001 and NIST AI RMF).

• Familiarity with TPRM processes, platforms (e.g., OneTrust) and vendor due diligence requirements.

• Preferred: experience reviewing client and/or vendor contracts, DPAs or security addenda against a standard template or risk matrix.

• Strong attention to detail, organization, and documentation skills.

• Ability to work collaboratively with technical and non-technical stakeholders.

What You'll Do

• Exercise sound judgment to effectively assess, communicate, balance and resolve risk in the provision of compliance guidance to the business.

• Partner with teams and data stewards to coordinate and perform various audits and assessments (PIA, DPIA, TIA, AI impact assessment, Data Inventories, etc.) as needed; Maintain risk registers and risk matrices to support PIMS,AIMS, etc.

• Support the AI governance intake process by reviewing AI intake forms, impact assessments, and service and model cards for completeness, following up with submitters and keeping the AI inventory current.

• Support and coordinate internal and external audits related to ISO 42001, ISO 27701, HITRUST, and other enterprise certifications.

• Execute and maintain the Third-Party Risk Management (TPRM), including vendor assessments, follow-ups, and documentation.

• Collaborate with Security, Privacy, and AI Governance teams to manage compliance activities and close audit findings.

• Assist in maintaining and improving compliance frameworks, policies, and procedures across enterprise functions, including desktop procedures for recurring GRC processes.

• Monitor control performance, gather evidence, and ensure documentation aligns with audit and regulatory expectations.

• Support monthly GRC metrics for Tech Ops client requests and vendor assessment cycle time, AI governance output, etc.

• Support and lead initiatives as assigned under the team’s GRC charter.