Head of Governance, Risk and Compliance

We are hiring a Head of Governance Risk and Compliance for our Trust and Intelligence organization a strategic leadership role accountable for establishing governance frameworks managing enterprise risk and ensuring regulatory and compliance adherence across the company. You will define how we operate responsibly and compliantly while enabling business growth and you will lead a growing team across compliance policy audit and emerging technology governance. This includes establishing governance frameworks for agentic AI systems ensuring responsible development security transparency and regulatory compliance as autonomous agents become core to our product strategy. 

Role overview 

As Head of Governance Risk and Compliance you own the governance risk and compliance framework across the entire organization. You are accountable for ensuring that Product and Technology Finance Operations Customer Success and all business functions operate in compliance with applicable laws regulations contractual obligations industry standards and internal policies. 

You serve as the central point of accountability for compliance risk regulatory relationships audit management risk governance policy frameworks and board-level reporting. This includes establishing governance frameworks for emerging technologies particularly agentic AI systems to ensure responsible development security transparency auditability and regulatory adherence. 

Your mandate is to transform compliance from a reactive audit-driven function into a proactive integrated capability that embeds compliance into business processes enables informed risk-taking and positions governance as a strategic enabler rather than a constraint. You will work closely with Product and Technology Finance Security Operations Observability AI/ML teams Legal Human Resources and executive leadership. Success requires balancing rigorous oversight with business enablement and building cross-functional ownership of compliance responsibilities across the organization. 

Duties and accountabilities 

Regulatory compliance and risk management 

• Maintain current understanding of applicable regulations across all business functions (data protection privacy financial industry-specific contractual obligations) and monitor regulatory changes to anticipate impact. 

• Conduct regulatory gap assessments compliance audits and controls testing to identify compliance risks and remediation needs. 

• Develop compliance roadmaps with clear implementation timelines and success criteria for achieving and maintaining regulatory adherence. 

• Manage regulatory relationships and lead audit coordination audit preparation and audit response across all regulatory bodies. 

• Establish incident response and breach of notification procedures; lead response to compliance incidents and regulatory violations. 

Enterprise risk governance and assessment 

• Define risk governance frameworks risk appetite statements and tolerance thresholds aligned with business strategy and stakeholder expectations. 

• Lead enterprise risk assessments across Product Technology Finance Operations and Customer Success to identify strategic operational financial technology and emerging technology risks. 

• Establish risk governance forums with business leaders to review prioritize and escalate material risks to executive and board leadership. 

• Own risk reporting to Board and executive leadership with clear risk status trends and mitigation progress. 

• Drive risk mitigation initiatives and track remediation of identified risks through to closure. 

Policy governance and control framework 

• Develop maintain and communicate organizational policies covering data protection privacy security financial operational and conduct requirements. 

• Establish control frameworks control standards and control testing procedures aligned with regulatory and business requirements. 

• Define governance forums decision authority escalation procedures and approval workflows for compliance-related decisions. 

• Monitor compliance with organizational policies through assessments audits and exception management. 

• Manage policy exceptions and waivers with clear approval authority risk assessment and remediation planning. 

Agentic AI and emerging technology governance 

• Establish governance frameworks and development standards for agentic AI systems including responsible AI principles transparency and auditability requirements. 

• Monitor emerging AI regulations (EU AI Act sector-specific AI requirements) and anticipate regulatory impact on agent development roadmaps. 

• Partner with Product and Technology to establish agent security controls addressing prompt injection data exposure unintended behavior and hallucination risks. 

• Define audit and observability requirements for agentic systems including decision logging behavior monitoring and explainability standards. 

• Conduct risk assessments of high-risk agent use cases; identify potential harms and mitigation strategies before deployment. 

• Establish agent development gates and approval processes for autonomous agent deployments; maintain emerging technology risk registry. 

Compliance enablement and culture 

• Build compliance capacity across the organization through training guidance and compliance support. 

• Partner with Product and Technology to embed compliance and emerging technology governance requirements into product roadmaps and architecture decisions. 

• Provide trusted compliance advice to business leaders on regulatory implications of new products partnerships business models and agent deployments. 

• Drive a compliance culture where ownership is distributed across the organization not siloed in compliance; position governance as business enablement. 

Regulatory compliance and risk management 

• Maintain current understanding of applicable regulations across all business functions (data protection privacy financial industry-specific contractual obligations) and monitor regulatory changes to anticipate impact. 

• Conduct regulatory gap assessments compliance audits and controls testing to identify compliance risks and remediation needs. 

• Develop compliance roadmaps with clear implementation timelines and success criteria for achieving and maintaining regulatory adherence. 

• Manage regulatory relationships and lead audit coordination audit preparation and audit response across all regulatory bodies. 

• Establish incident response and breach notification procedures; lead response to compliance incidents and regulatory violations. 

Enterprise risk governance and assessment 

• Define risk governance frameworks risk appetite statements and tolerance thresholds aligned with business strategy and stakeholder expectations. 

• Lead enterprise risk assessments across Product Technology Finance Operations and Customer Success to identify strategic operational financial technology and emerging technology risks. 

• Establish risk governance forums with business leaders to review prioritize and escalate material risks to executive and board leadership. 

• Own risk reporting to Board and executive leadership with clear risk status trends and mitigation progress. 

• Drive risk mitigation initiatives and track remediation of identified risks through closure. 

Policy governance and control framework 

• Develop maintain and communicate organizational policies covering data protection privacy security financial operational and conduct requirements. 

• Establish control frameworks control standards and control testing procedures aligned with regulatory and business requirements. 

• Define governance forums decision authority escalation procedures and approval of workflows for compliance-related decisions. 

• Monitor compliance with organizational policies through assessments audits and exception management. 

• Manage policy exceptions and waivers with clear approval of authority risk assessment and remediation planning. 

Agentic AI and emerging technology governance 

• Establish governance frameworks and development standards for agentic AI systems including responsible AI principles transparency and auditability requirements. 

• Monitor emerging AI regulations (EU AI Act sector-specific AI requirements) and anticipate regulatory impact on agent development roadmaps. 

• Partner with Product and Technology to establish agent security controls addressing prompt injection data exposure unintended behavior and hallucination risks. 

• Define audit and observability requirements for agentic systems including decision logging behavior monitoring and explainability standards. 

• Conduct risk assessments of high-risk agent use cases; identify potential harms and mitigation strategies before deployment. 

• Establish agent development gates and approval processes for autonomous agent deployments; maintain emerging technology risk registry. 

Compliance enablement and culture 

• Build compliance capacity across the organization through training guidance and compliance support. 

• Partner with Product and Technology to embed compliance and emerging technology governance requirements into product roadmaps and architecture decisions. 

• Provide trusted compliance advice to business leaders on regulatory implications of new products partnerships business models and agent deployments. 

• Drive a compliance culture where ownership is distributed across the organization not siloed in compliance; position governance as business enablement. 

What success looks like 

• Compliance and regulatory requirements are met through real controls and proactive management not last-minute scrambles or findings during audits. 
• Risk governance frameworks are transparent understood and used by business leaders to make informed decisions about risk and opportunity. 
• Agentic AI systems are governed with clear standards for responsible development security transparency and auditability; agents deploy with confidence and customer trust. 
• Compliance ownership is distributed across the organization; business leaders view GRC as a trusted partner and enabler not a blocker. 
• Business leaders proactively raise compliance and risk questions rather than waiting for GRC to identify issues. 
• Regulatory and customer confidence is strong; audit results reflect an organization operating with integrity and control.

Qualifications :

Required skills and experience 

Proven experience in governance risk management compliance audit legal or regulatory affairs in regulated or high-compliance industries. 

Proven track record establishing and leading GRC programs at enterprise scale including regulatory compliance risk management and internal controls. 

Deep expertise in data protection and privacy regulations (GDPR CCPA) and experience with compliance certifications (SOC 2 ISO 27001 etc.). 

Strong background in risk assessment risk modeling and enterprise risk governance frameworks. 

Demonstrated experience managing regulatory audits audit preparation remediation tracking and regulatory relationships. 

Experience leading and developing teams across compliance policy audit and risk management functions. 

Familiarity with emerging technology governance AI/ML governance frameworks and understanding of evolving AI regulations. 

Strong communication and influence skills; ability to translate regulatory requirements and risk concepts for business stakeholders and executives. 

Demonstrated ability to balance risk management and business enablement positioning compliance as a strategic advantage rather than a constraint. 

Scope and expectations 

Leadership role accountable for governance risk and compliance strategy across the entire organization. 

Covers regulatory compliance enterprise risk governance policy frameworks control architecture and emerging technology (agentic AI) governance not one domain or function. 

Expected to establish standards convene cross-functional forums and drive compliance decisions with authority; reports directly to VP of Trust and Intelligence. 

Expected to raise and escalate risks even when inconvenient or challenging to business plans. 

People-management role with responsibility for building and developing the GRC team (5-8 people) across compliance policy audit and emerging technology governance specialties. 

Nice to have 

Experience in a software technology or SaaS company with significant regulatory or compliance obligations. 

Direct experience leading compliance programs supporting SOC 2 FedRAMP ISO 27001 or similar certifications. 

Familiarity with EU cybersecurity and data-protection regulations relevant to global SaaS/cloud vendors. 

Demonstrated track record securing Board-level support and investment for compliance and governance initiatives. 

Experience managing compliance for AI/ML or generative AI products and services. 

Relevant advanced certifications (e.g. CCSA CGAP or equivalent) not mandatory. 

Qualifications 

Core required qualifications 

Demonstrated experience designing and implementing GRC programs across regulatory compliance risk management and internal controls. 

Working knowledge of major regulatory frameworks and standards applicable to software/SaaS (GDPR CCPA SOC 2 ISO 27001 FedRAMP NIST). 

Practical experience conducting and managing regulatory audits including remediation and control validation. 

Strong risk assessment and risk governance experience; familiarity with enterprise risk frameworks and risk modeling. 

Proven ability to develop and communicate compliance policies standards and procedures clearly to technical and non-technical audiences. 

Experience leading teams and developing talent in compliance audit policy and risk management functions. 

Strong communication and stakeholder management skills; demonstrated ability to influence across organizational boundaries without formal authority over all functions. 

Preferred qualifications 

10 years of experience in governance risk compliance audit or regulatory roles in regulated industries (financial services healthcare public sector enterprise SaaS). 

Track record leading GRC transformations; moving organizations from reactive to proactive compliance and governance. 

Demonstrated success managing complex multi-stakeholder compliance programs (regulatory bodies boards auditors business leaders customers). 

Direct experience with emerging technology governance AI/ML governance frameworks or managing governance of novel/rapidly evolving technologies. 

Experience building and scaling high-performing teams in compliance and risk management; demonstrated talent development success. 

Proven ability to secure executive and Board support for compliance initiatives; experience communicating technical compliance concepts to non-technical audiences. 

Additional Information :

We embrace flexibility and hybrid work opportunities to support diverse needs and lifestyles while also valuing inclusive workplace experiences. By fostering a sense of community we drive innovation strengthen connections and nurture belonging. Our commitment ensures you can work in a way that suits you best while also engaging with colleagues to share ideas and build meaningful relationships. 

Remote Work :

No

Employment Type :

Full-time