AI Risk & Compliance Analyst

Whoop; Boston (MA); On-site; USD 100,000 - 140,000; Full time

Job summary

WHOOP, based in Boston, MA, seeks a Governance, Risk, and Compliance Analyst II to lead day-to-day GRC operations for AI and risk management in a fast-growing environment. This role collaborates with Legal, Security, Product, and other teams to advance compliance objectives and strengthen operational resilience.

The ideal candidate has 6+ years in GRC, strong AI governance experience, and the ability to translate complex risk into clear requirements.

Qualifications

• 6+ years of experience in Governance, Risk & Compliance.
• Experience performing governance or risk assessments for AI/ML systems, including LLM integrations.
• Experience translating AI-specific risks into documented control requirements and governance standards.
• Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or ML service providers.
• Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, GDPR, PCI DSS, or similar standards.
• Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field.

Responsibilities

• Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows.
• Partner with the Senior Security Engineer, AI/ML to translate risk assessment findings into GRC frameworks and governance requirements.
• Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks and standards.
• Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring and remediation tracking.
• Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls and evidence collection.
• Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external reviews.
• Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains and compliance obligations.
• Facilitate AI risk and compliance reporting to leadership with dashboards and metrics.
• Monitor emerging AI governance requirements and translate them into program updates and recommendations.
• Support security incident documentation and post-incident analysis for AI system events with Legal and Security teams.

Skills

GRC governance

AI risk assessment

Third‑party risk management

Policy development

Audit coordination

Regulatory readiness

Cross‑functional collaboration

Education

Bachelor’s degree in Information Security

Job description

At WHOOP, we are on a mission to unlock human performance and extend healthspan. The Governance, Risk, and Compliance (GRC) team helps ensure technology and cybersecurity risks are identified, assessed, and communicated clearly across the organization.

WHOOP is seeking a Governance, Risk, and Compliance Analyst II, to lead the day‑to‑day operation and support the ongoing risk management program at GRC in a fast‑paced, high‑growth environment. This role is responsible for operations of GRC initiatives—including, but not limited to, structured cybersecurity and AI risk assessments, exceptions management, SDLC reviews and security compliance process ownership. The role will partner closely with Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk, and strengthen operational resilience.

The ideal candidate combines strong analytical thinking, a critical risk mindset, familiarity with AI governance, and the ability to communicate complex risk scenarios clearly to both technical and non‑technical stakeholders.

Responsibilities

• Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval‑augmented workflows.
• Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into GRC frameworks and translate technical risk into governance requirements.
• Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks, including ISO/IEC 42001, NIST Cybersecurity Framework, NIST AI Risk Management Framework, EU AI Act, GDPR, and other applicable standards.
• Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third‑party risk scoring, control mapping, and remediation tracking.
• Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls, evidence collection, and follow‑up on remediation items.
• Support audit activities, capturing evidence and coordinating cross‑functional stakeholders for internal and external compliance reviews involving AI systems.
• Develop and maintain AI‑specific GRC policies, standards, and procedures that map to AI risk domains, explainability requirements, and compliance obligations.
• Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend analysis, control effectiveness measurements, and key metrics.
• Monitor emerging AI governance requirements, guidance, and best practices, translating them into GRC program updates and compliance recommendations.
• Support security incident documentation and post‑incident analysis for AI system events, coordinating with Legal and Security teams to ensure appropriate governance response.

Qualifications

• 6+ years of experience in Governance, Risk & Compliance, including risk assessment, policy development, audit coordination, and third‑party risk management.
• Demonstrated experience performing governance or risk assessments for AI/ML systems, including LLM integrations, model pipelines, AI agents, or data‑driven algorithmic systems.
• Experience translating AI‑specific risks (data poisoning, prompt injection, model misuse, data leakage, explainability gaps) into documented control requirements and governance standards.
• Hands‑on experience conducting third‑party risk assessments for AI vendors, LLM platforms, AI APIs, or machine‑learning service providers.
• Experience mapping AI‑related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, GDPR, PCI DSS, or similar standards.
• Strong understanding of data governance concepts relevant to AI systems, including training data lineage, data retention, model output handling, and human oversight requirements.
• Experience supporting regulatory readiness or compliance efforts related to AI systems.
• Proven ability to collaborate with engineering and security teams to validate control implementation and remediation.
• Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field.

This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.

Compensation and Benefits

U.S. base salary range for this full‑time position is $100,000 - $140,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job‑related skills, experience, performance, and relevant education or training.

In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Equal Opportunity Employer

WHOOP is an Equal Opportunity Employer and participates in E‑verify to determine employment eligibility.