AI Governance Engineer

Luxoft; Buffalo (NY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Luxoft seeks an AI Governance Engineer in Buffalo, NY to serve as the technical production engine behind the bank's AI standards and controls build-out. You will draft the standards library, engineer controls as testable requirements, and produce documentation and automation to operationalize governance for enterprise AI initiatives.

The role collaborates with platform capabilities, expresses controls in verifiable terms, and contributes to policy-as-code and evidence automation while ensuring

Qualifications

• Minimum of 5 years' experience in technology governance, IT risk/controls, or compliance engineering in a technology environment.
• Experience writing technical standards, control frameworks, or control documentation mapping to regulatory obligations.
• Working knowledge of cloud platforms and modern patterns: APIs, gateways, IAM/RBAC, logging, monitoring, environment separation.
• Familiarity with AI/GenAI systems to write enforceable requirements for model access, oversight, and logging.
• Strong technical writing and documentation discipline, producing artifacts that survive audit and second-line challenges.
• Experience with GRC processes: exceptions, findings, evidence collection, and remediation tracking.

Responsibilities

• Draft and iterate the AI standards library under the Lead's direction: model onboarding and approval, oversight tiers, logging/retention, agentic guardrails, data-classification handling, and acceptable use.
• Engineer each control as a testable requirement: definition, enforcement point, owner, evidence artifact, and validation method.
• Build and maintain obligation-to-control-to-evidence mappings against regulatory guidance and internal policy.
• Contribute to policy-as-code and controls-automation approaches with the platform team where controls can be enforced or checked mechanically.
• Produce evidence artifacts, control attestations, and assessment documentation for deviations, exceptions, and governance reviews.
• Validate platform-generated evidence (audit logs, entitlement records, quota enforcement) against control requirements; document gaps and drive fixes.
• Support deviation and exception lifecycle management: drafting, compensating-control documentation, tracking, and closure evidence.
• Assemble components of examiner-readiness and audit-response packages.
• Governance Operations Support: assist AI Control Group, working group, and committee operations with prepared materials and documented decisions.
• Maintain the AI use case and agent registry data quality in partnership with intake and platform onboarding.
• Document governance processes, runbooks, and templates in bank repositories for FTE handover.
• Transfer working knowledge to bank FTEs throughout the engagement.

Skills

Technology governance

IT risk controls

Security governance

Compliance engineering

Technical standards writing

Control frameworks

APIs & gateways

Identity & RBAC

Logging & monitoring

GenAI governance

Policy-as-code

GRC processes

Job description

• The AI Governance Engineer is the technical production engine behind the bank's AI standards and controls build-out. Working under the direction of the AI Governance & Controls Lead, this role drafts the standards library, engineers controls as implementable and testable requirements, builds control-to-evidence mappings, and produces the documentation and automation that make governance operational rather than aspirational.
• This is a technical governance role, not a policy-writing role alone: the engineer works directly with platform capabilities (gateway policies, entitlements, logging), expresses controls in verifiable terms, contributes to policy-as-code and evidence automation where feasible, and validates that what the standard requires is what the platform enforces.

Responsibilities

• gDraft and iterate the AI standards library under the Lead's direction: model onboarding and approval, oversight tiers, logging/retention, agentic guardrails, data-classification handling, and acceptable use
• .Engineer each control as a testable requirement: definition, enforcement point, owner, evidence artifact, and validation method
• .Build and maintain obligation-to-control-to-evidence mappings against regulatory guidance and internal policy
• .Contribute to policy-as-code and controls-automation approaches with the platform team where controls can be enforced or checked mechanically
• .Evidence & Assessment Productio
• nProduce evidence artifacts, control attestations, and assessment documentation for deviations, exceptions, and governance reviews
• .Validate platform-generated evidence (audit logs, entitlement records, quota enforcement) against control requirements; document gaps and drive fixes
• .Support deviation and exception lifecycle management: drafting, compensating-control documentation, tracking, and closure evidence
• .Assemble components of examiner-readiness and audit-response packages
• .Governance Operations Suppor
• tSupport AI Control Group, working group, and committee operations with prepared materials, assessments, and documented decisions
• .Maintain the AI use case and agent registry data quality in partnership with intake and platform onboarding
• .Document governance processes, runbooks, and templates in bank repositories for FTE handover
• .Transfer working knowledge to bank FTEs throughout the engagement

Mandatory Skills Descriptio

n:First 2 weeks hybrid , then remote and business trips for 2-3 weeks few times per yea

• r.Minimum of 5 years' experience in technology governance, IT risk/controls, security governance engineering, or compliance engineering in a technology environmen
• t.Demonstrated experience writing technical standards, control frameworks, or control documentation that maps to regulatory or policy obligation
• s.Working technical knowledge of cloud platforms and modern application patterns: APIs and gateways, identity/RBAC, logging and monitoring, environment separatio
• n.Familiarity with AI/GenAI systems sufficient to write accurate, enforceable requirements for model access, oversight, and loggin
• g.Strong technical writing and documentation discipline; able to produce artifacts that survive audit and second-line challeng
• e.Experience with GRC processes: exceptions, findings, evidence collection, and remediation trackin

Nice-to-Have Skills Descripti

• on:Financial services or other highly regulated industry experience; familiarity with model risk management concep
• ts.Experience with policy-as-code, compliance automation, or controls testing automati
• on.Familiarity with NIST AI RMF, SR 11-7/SR 26-2 lineage, or comparable AI governance framewor