AI Governance Engineer

Luxoft; Wilmington (DE); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Luxoft is seeking an AI Governance Engineer to drive the bank's AI standards and controls build-out. You will draft the standards library, engineer controls as testable requirements, and map evidence to regulatory guidance.

The role collaborates with platform teams to ensure enforcement through policy-as-code and automated evidence generation. Responsibilities include building control-to-evidence mappings, creating audit-ready artifacts, and supporting deviation lifecycle management.

Qualifications

• Minimum of 5 years' experience in technology governance, IT risk/controls, security governance engineering, or compliance engineering in a technology environment.
• Experience writing technical standards, control frameworks, or control documentation that maps to regulatory or policy obligations.
• Technical knowledge of cloud platforms and modern application patterns: APIs and gateways, identity/RBAC, logging and monitoring, environment separation.
• Familiarity with AI/GenAI systems sufficient to write accurate, enforceable requirements for model access, oversight, and logging.
• Strong technical writing and documentation discipline; artifacts that survive audit and second-line challenges.
• Experience with GRC processes: exceptions, findings, evidence collection, and remediation tracking.

Responsibilities

• Draft and iterate the AI standards library under the Lead's direction: model onboarding and approval, oversight tiers, logging/retention, agentic guardrails, data-classification handling, and acceptable use.
• Engineer each control as a testable requirement: definition, enforcement point, owner, evidence artifact, and validation method.
• Build and maintain obligation-to-control-to-evidence mappings against regulatory guidance and internal policy.
• Contribute to policy-as-code and controls-automation approaches with the platform team where controls can be enforced or checked mechanically.
• Produce evidence artifacts, control attestations, and assessment documentation for deviations, exceptions, and governance reviews.
• Validate platform-generated evidence (audit logs, entitlement records, quota enforcement) against control requirements; document gaps and drive fixes.
• Support deviation and exception lifecycle management: drafting, compensating-control documentation, tracking, and closure evidence.
• Assemble components of examiner-readiness and audit-response packages.
• Governance Operations Support
• Support AI Control Group, working group, and committee operations with prepared materials, assessments, and documented decisions.
• Maintain the AI use case and agent registry data quality in partnership with intake and platform onboarding.
• Document governance processes, runbooks, and templates in bank repositories for FTE handover.
• Transfer working knowledge to bank FTEs throughout the engagement.

Skills

Technology governance

IT risk & controls

Security governance

Compliance engineering

Technical writing

GRC processes

Tools

Policy-as-code

Job description

The AI Governance Engineer is the technical production engine behind the bank's AI standards and controls build-out. Working under the direction of the AI Governance & Controls Lead, this role drafts the standards library, engineers controls as implementable and testable requirements, builds control-to-evidence mappings, and produces the documentation and automation that make governance operational rather than aspirational.

• This is a technical governance role, not a policy-writing role alone: the engineer works directly with platform capabilities (gateway policies, entitlements, logging), expresses controls in verifiable terms, contributes to policy-as-code and evidence automation where feasible, and validates that what the standard requires is what the platform enforces.

Responsibilities

• gDraft and iterate the AI standards library under the Lead's direction: model onboarding and approval, oversight tiers, logging/retention, agentic guardrails, data-classification handling, and acceptable use
• .Engineer each control as a testable requirement: definition, enforcement point, owner, evidence artifact, and validation method
• .Build and maintain obligation-to-control-to-evidence mappings against regulatory guidance and internal policy
• .Contribute to policy-as-code and controls-automation approaches with the platform team where controls can be enforced or checked mechanically
• .Evidence & Assessment Productio
• nProduce evidence artifacts, control attestations, and assessment documentation for deviations, exceptions, and governance reviews
• .Validate platform-generated evidence (audit logs, entitlement records, quota enforcement) against control requirements; document gaps and drive fixes
• .Support deviation and exception lifecycle management: drafting, compensating-control documentation, tracking, and closure evidence
• .Assemble components of examiner-readiness and audit-response packages
• .Governance Operations Suppor
• tSupport AI Control Group, working group, and committee operations with prepared materials, assessments, and documented decisions
• .Maintain the AI use case and agent registry data quality in partnership with intake and platform onboarding
• .Document governance processes, runbooks, and templates in bank repositories for FTE handover
• .Transfer working knowledge to bank FTEs throughout the engagement

Mandatory Skills Description:

First 2 weeks hybrid , then remote and business trips for 2-3 weeks few times per y e

• ar.Minimum of 5 years' experience in technology governance, IT risk/controls, security governance engineering, or compliance engineering in a technology environme
• nt.Demonstrated experience writing technical standards, control frameworks, or control documentation that maps to regulatory or policy obligatio
• ns.Working technical knowledge of cloud platforms and modern application patterns: APIs and gateways, identity/RBAC, logging and monitoring, environment separati
• on.Familiarity with AI/GenAI systems sufficient to write accurate, enforceable requirements for model access, oversight, and loggi
• ng.Strong technical writing and documentation discipline; able to produce artifacts that survive audit and second-line challen
• ge.Experience with GRC processes: exceptions, findings, evidence collection, and remediation tracki

Nice-to-Have Skills Descript

• ion:Financial services or other highly regulated industry experience; familiarity with model risk management conce
• pts.Experience with policy-as-code, compliance automation, or controls testing automat
• ion.Familiarity with NIST AI RMF, SR 11-7/SR 26-2 lineage, or comparable AI governance framewo