AI Governance & Risk Analyst

Whoop; Boston (MA); On-site; USD 100,000 - 140,000; Full time

Job summary

WHOOP, based in Boston, MA, seeks a Governance, Risk, and Compliance Analyst II to lead day-to-day GRC operations for AI and risk management in a fast-growing environment. This role collaborates with Legal, Security, Product, and other teams to advance compliance objectives and strengthen operational resilience.

The ideal candidate has 6+ years in GRC, strong AI governance experience, and the ability to translate complex risk into clear requirements.

Qualifications

• 6+ years of experience in Governance, Risk & Compliance.
• Experience performing governance or risk assessments for AI/ML systems, including LLM integrations.
• Experience translating AI-specific risks into documented control requirements and governance standards.
• Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or ML service providers.
• Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, GDPR, PCI DSS, or similar standards.
• Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field.

Responsibilities

• Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows.
• Partner with the Senior Security Engineer, AI/ML to translate risk assessment findings into GRC frameworks and governance requirements.
• Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks and standards.
• Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring and remediation tracking.
• Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls and evidence collection.
• Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external reviews.
• Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains and compliance obligations.
• Facilitate AI risk and compliance reporting to leadership with dashboards and metrics.
• Monitor emerging AI governance requirements and translate them into program updates and recommendations.
• Support security incident documentation and post-incident analysis for AI system events with Legal and Security teams.

Skills

GRC governance

AI risk assessment

Third‑party risk management

Policy development

Audit coordination

Regulatory readiness

Cross‑functional collaboration

Education

Bachelor’s degree in Information Security

Job description

WHOOP, based in Boston, MA, seeks a Governance, Risk, and Compliance Analyst II to lead day-to-day GRC operations for AI and risk management in a fast-growing environment. This role collaborates with Legal, Security, Product, and other teams to advance compliance objectives and strengthen operational resilience.

The ideal candidate has 6+ years in GRC, strong AI governance experience, and the ability to translate complex risk into clear requirements.