Lead, M365 AI Governance & Risk

Nordea Bank Norge ASA; Łódź; Hybrid; PLN 80,000 - 120,000; Full time

Benefits offered by this job

Hybrid working model

Job summary

Nordea Bank Abp is seeking a M365 AI Governance & Risk Lead to own governance, risk and controls for agentic AI and Microsoft 365 AI capabilities across a hybrid work environment. You will partner with security, privacy and legal to ensure regulatory alignment and operational excellence across Poland, Finland and Denmark.

The role requires translating complex compliance expectations into practical controls, managing service lifecycle, and aligning with strategic roadmaps while coordinating

Qualifications

• Strong experience in governance, risk management, compliance, audit, information security or technology risk.
• Good understanding of Microsoft 365, including other Microsoft agentic AI platforms, collaboration platforms, data protection and enterprise controls.
• Awareness of broader enterprise AI platforms such as Gemini, Claude or similar GenAI solutions, and ability to assess their governance, risk and compliance implications in comparison with Microsoft 365 AI capabilities.
• Experience coordinating cross-functional reviews with security, privacy, compliance, legal and business stakeholders.
• Ability to write clear policies, operating models, decision papers, control descriptions and management-ready summaries.
• Understanding of GDPR, EU AI Act, information classification, DLP and risk management in a regulated environment.
• Strong facilitation, communication and stakeholder management skills in English.

Responsibilities

• Define and maintain the Microsoft 365 AI and agentic AI governance model.
• Establish rules for allowed, conditional and prohibited use cases for Copilot Agents, Co-work and related Microsoft 365 AI capabilities.
• Maintain governance requirements for agents published or shared in the tenant.
• Ensure new and changed AI capabilities are risk assessed in coordination with data privacy, compliance, legal, Group AI and security departments.
• Ensure AI enablement follows data protection and security, auditability and regulated-environment requirements.
• Define evidence requirements for risk reviews, audits, management reporting and control validation.
• Translate internal policies, regulatory expectations and risk decisions into practical controls, guidance and operating procedures.
• Work closely with platform architecture and operations roles to ensure governance is technically enforceable and embedded into day-to-day platform operations.
• Own the service lifecycle for Microsoft 365 AI governance & agentic AI capabilities, including portfolio rationalization, capacity, configuration, performance, availability and lifecycle roadmap alignment.
• Ensure the service operates according to agreed budgets, KPIs, service levels and managed service expectations, including follow-up on operational quality and service performance.
• Initiate and drive continuous improvement, cost optimization and total cost of ownership considerations for the Microsoft 365 AI governance service and related controls.
• Ensure required improvements, risk mitigations, compliance actions and audit findings are prioritized in relevant backlogs and followed through to closure.
• Drive alignment and collaboration with Business Area Technology Leads, application owners, business service owners, execution leads, key business stakeholders and IT stakeholders to manage priorities, escalations and impediments.

Skills

Governance & risk management

Compliance & audit

Information security

Microsoft 365 AI governance

Policy writing & operating models

English communication

Tools

Jira

Confluence

ServiceNow

Job description

Nordea Bank Abp is seeking a M365 AI Governance & Risk Lead to own governance, risk and controls for agentic AI and Microsoft 365 AI capabilities across a hybrid work environment. You will partner with security, privacy and legal to ensure regulatory alignment and operational excellence across Poland, Finland and Denmark.

The role requires translating complex compliance expectations into practical controls, managing service lifecycle, and aligning with strategic roadmaps while coordinating