AI Governance & Risk Analyst

Unió Digital; Tucson, Northern (AZ, KY); Hybrid; USD 90,000 - 120,000; Full time

Job summary

Unió Digital is seeking an AI Governance & Risk Analyst to operate the Managed AI program from Tucson, AZ or remotely. You will own AI policy maintenance, vendor risk monitoring, DPA management, and quarterly evidence packaging for client audits and insurance reviews.

This mid-senior role emphasizes policy discipline and strong written communication. Ideal candidates have 3+ years in IT governance or risk analysis, familiarity with HIPAA, SOC 2, NIST CSF, NIST AI RMF, and ISO 42001, and comfort

Qualifications

• 3+ years in IT governance, security GRC, or comparable risk-analysis role.
• Strong written communication and policy-drafting discipline.
• Familiarity with regulatory frameworks (HIPAA, SOC 2, NIST CSF, NIST AI RMF, ISO 42001).
• Comfortable with technical security data (DNS logs, M365 audit, SIEM extracts).

Responsibilities

• Maintain AI Acceptable Use Policy templates with vertical addenda (construction, mining, healthcare).
• Run DNS-layer shadow AI monitoring and produce the monthly AI Usage Report.
• Manage Data Processing Agreements and BAA inventories with AI vendors.
• Package quarterly evidence for client audit and insurance review.
• Primary point of contact for AI-specific incident response.

Skills

IT governance

GRC risk analysis

Policy drafting

Regulatory frameworks familiarity

Job description

# AI Governance & Risk AnalystOperates the Managed AI program for our clients on a recurring cadence. Maintains AI Acceptable Use Policy templates, runs DNS-layer shadow AI monitoring, manages Data Processing Agreements and BAA inventories, and packages quarterly evidence for client audit and insurance review.Full-TimeTucson, AZ or RemoteMid-SeniorApply for this RoleView All Roles## Location & TravelHiring locations: * Tucson, AZ * RemoteTravel requirement: No regular travel required.International travel: Not required.## About this roleThe AI Governance & Risk Analyst operates the Managed AI program for our clients on a recurring cadence. You'll own AI policy maintenance, vendor risk monitoring, DPA management, and quarterly evidence packaging. Primary point of contact for AI-specific incident response.## What you'll do* Maintain AI Acceptable Use Policy templates with vertical addenda (construction, mining, healthcare)* Run DNS-layer shadow AI monitoring and produce the monthly AI Usage Report* Manage Data Processing Agreements and BAA inventories with AI vendors* Package quarterly evidence for client audit and insurance review* Primary point of contact for AI-specific incident response## What we're looking for* 3+ years in IT governance, security GRC, or comparable risk-analysis role* Strong written communication and policy-drafting discipline* Familiarity with regulatory frameworks (HIPAA, SOC 2, NIST CSF, NIST AI RMF, ISO 42001)* Comfortable with technical security data (DNS logs, M365 audit, SIEM extracts)* Eligible to work in the U.S.You'll always hear from usEvery applicant gets a status update within 5 business days. See our 4-stage hiring process on the careers page.## Ready to apply?Submit your resume and a few details. We review every application personally.