Principal - Cybersecurity Audit, Risk & Governance Architect – AI & Emerging Tech

Cybersecurity Jobs; Ashburn (VA); Hybrid; USD 121,000 - 231,000; Full time

Benefits offered by this job

Medical, Dental, Vision

Matched 401(k) savings plan

Paid parental leave

Tuition assistance

Life insurance

Job summary

Cybersecurity Jobs in Ashburn, VA is seeking a Principal Security Risk & Compliance lead to shape audits, governance, and risk management across enterprise AI programs and emerging networks. The role is hybrid in Ashburn, with a focus on aligning security compliance with enterprise risk management for auditable AI deployments.

The candidate will design an AI risk management framework, lead SOC 2 Type II and ISO 27001 audits, assess AI vendor security and data practices, and guide product teams

Qualifications

• Bachelor’s degree or four or more years of work experience.
• Six or more years of relevant experience in Information Security Risk Management, IT Audit, or GRC.
• Experience evaluating risks tied to AI/ML systems, LLMs, data pipeline security, or AI vendor tools.
• Proven track record leading SOC 2 Type II audits and ISO 27001 certifications.
• Familiarity with NIST SP 800-53/800-171, NIST CSF, PCI-DSS, HIPAA, and AI frameworks like NIST AI RMF.
• Understanding of cloud infrastructure (AWS/GCP/Azure), API security, data pipeline architecture, SDLC.

Responsibilities

• Design, implement, and maintain AI risk management framework aligned to NIST AI RMF, ISO 42001 and EU AI Act.
• Lead end-to-end internal and external security audits (SOC 2 Type II, ISO 27001) with evidence collection and remediation tracking.
• Assess third-party AI and SaaS providers for security posture and regulatory compliance.
• Conduct security risk assessments and threat modeling for AI/ML initiatives, LLM integrations, and core platform capabilities.
• Advise Product, Engineering, and Business on Security & Privacy by Design within roadmaps.
• Create metrics, KRIs, and dashboards for the CISO and Executive Risk Committee.

Skills

Security risk management

IT audit

GRC

SOC 2 Type II

ISO 27001

NIST CSF

AI/ML risk assessment

Education

Bachelor’s degree

Tools

Vanta

Drata

LogicGate

ServiceNow

Job description

In this Principal Security Risk & Compliance lead role, you will help shape how an organization audits, governs, and manages security risk across enterprise AI programs and emerging network technologies. Working in a hybrid environment in Ashburn, you will connect security compliance with broader enterprise risk management to support safe, auditable deployment of AI capabilities.

What You’ll Do

• Design, implement, and maintain the enterprise AI Risk Management Framework aligned to NIST AI RMF, ISO 42001, and emerging global regulations such as the EU AI Act.
• Lead end-to-end internal and external security audits, including SOC 2 Type II and ISO 27001, by managing evidence collection, remediation tracking, and auditor relationships.
• Assess third-party AI and SaaS providers for security posture, data privacy practices (including usage and training data retention), and regulatory compliance.
• Conduct security risk assessments and threat modeling for new AI/ML initiatives, LLM integrations, and core platform capabilities.
• Act as the primary security risk advisor to Product, Engineering, and Business leaders, supporting “Security & Privacy by Design” within product roadmaps.
• Create metrics, KRIs, and reporting dashboards for the CISO and Executive Risk Committee covering compliance status and emerging AI risks.

What You’ll Need

• Bachelor’s degree or four or more years of work experience.
• Six or more years of relevant experience, shown through work and/or military experience, or specialized training.
• Six or more years of progressive experience in Information Security Risk Management, IT Audit, or Governance, Risk, and Compliance (GRC).
• Experience evaluating risks tied to AI/ML systems, Large Language Models (LLMs), data pipeline security, or AI vendor tools.
• A proven track record leading SOC 2 Type II audits, ISO 27001 certifications, or regulatory compliance programs from preparation through remediation.
• Deep familiarity with NIST SP 800-53, NIST SP 800-171, NIST CSF, SOC 2 Type II, ISO 27001, PCI-DSS, and HIPAA, plus AI frameworks such as NIST AI RMF and OWASP LLM Top 10.
• Basic understanding of cloud infrastructure (AWS/GCP/Azure), API security, data pipeline architecture, or SDLC.

Technologies and Frameworks

• NIST AI RMF
• ISO 42001
• EU AI Act
• SOC 2 Type II
• ISO 27001
• NIST SP 800-53 / NIST SP 800-171
• NIST CSF
• PCI-DSS
• HIPAA
• OWASP LLM Top 10
• AWS, GCP, Azure
• SDLC

Even Better If You Have

• One or more certifications including IAPP Artificial Intelligence Governance Professional (AIGP), CDPSE, CRISC, CISA, CISSP, and/or CISM.
• Experience implementing or operating GRC automation platforms such as Vanta, Drata, LogicGate, or ServiceNow, including experience setting up Continuous Control Monitoring (CCM) or automated evidence-polling integrations.
• Knowledge and experience managing multiple simultaneous assessments and audits for continuous authorizations.
• Exceptional written and verbal communication skills, with the ability to translate complex technical and regulatory requirements into actionable business guidance.

Location, Type, and Schedule

• Location: Ashburn, VA (hybrid)
• Type: Full-time
• Schedule: 40 hours per week

Hybrid Work Expectations

• Hybrid role with a defined work location that includes working from home and a minimum of three days per week in the office, set by your manager.
• Employees are responsible for maintaining compliance with hybrid work policies.

Compensation and Benefits

• Salary: USD 120,500 - 231,000 per year
• Medical, Dental, Vision
• Short and long term disability
• Basic life insurance, Supplemental life insurance, AD&D insurance
• Identity theft protection
• Pet insurance
• Group home & auto insurance
• Matched 401(k) savings plan
• Up to 8 company paid holidays per year
• Up to 6 personal days per year, paid
• Paid parental leave
• Adoption assistance
• Tuition assistance
• Opportunity for compensation in the form of premium pay such as overtime, shift differential, holiday pay, and allowances
• Newly hired employees receive up to 15 days of vacation per year, which grows with additional service
• Compensation adjusted for part-time roles based on hours
• Salary incentive based position with potential to earn more