Sr. Enterprise Risk Governance Specialist

About this role

OUR MISSION

Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all.

ROLE OVERVIEW

The Sr. Enterprise Risk Governance Specialist position is a senior role within Enterprise Risk & Trust, reporting to the Head of Enterprise Risk & Trust. This is the hands-on expert and builder behind the organization’s enterprise risk management and control environment — personally designing, operating, and continuously maturing the frameworks, inventories, controls, and reporting that keep the organization within its stated risk appetite while advancing its strategic objectives. This specialist owns and executes the technical substance of risk governance across its full lifecycle: obligation identification, control architecture, risk measurement, reporting, and external representation.

Sitting at the intersection of risk, compliance, technology, and AI safety, this role is uniquely positioned to shape how the organization understands and responds to a dynamic regulatory and operational risk landscape. The ideal candidate brings deep expertise in enterprise risk frameworks, a systems-level perspective on controls design, and the personal credibility to represent the organization’s risk posture to regulators, customers, auditors, and other critical external stakeholders.

This is a high-visibility, high-impact individual-contributor role that operates across all business functions. Success requires the ability to translate complex risk concepts into actionable governance structures, influence without direct authority, and build trusted relationships internally and externally.

WHAT YOU'LL DO

CONTROL ENVIRONMENT & RISK FRAMEWORK ARCHITECTURE

- Design, build, and operate a control environment that drives efficient, prioritized adherence to organizational obligations in alignment with management’s objectives and stated risk appetite.

- Design and continuously operate an enterprise risk management framework spanning risk identification, measurement, mitigation, monitoring, and reporting — contextualized against the organization’s obligations, objectives, and risk tolerance.

- Establish and apply a disciplined approach to risk prioritization that balances operational efficiency with the rigor required to address high-severity exposures across the enterprise.

POLICY, STANDARDS & CONTROLS GOVERNANCE

- Operate the organization’s policy and standards issuance lifecycle, ensuring timely coverage of emerging obligations and strategic priorities.

- Design, implement, and maintain the controls and guardrails that drive adherence to obligations and objectives within defined risk appetite thresholds.

- Build and maintain a structured controls taxonomy and policy hierarchy, ensuring alignment, traceability, and clear ownership across the enterprise.

ENTERPRISE INVENTORIES & DATA STEWARDSHIP

- Own and maintain the enterprise risk registry and control inventory, ensuring completeness, accuracy, and operationalization across all relevant functions.

- Steward the design, quality, and utilization of key risk-related ecosystem inventories, including data inventories, IT asset inventories, and other foundational records management infrastructure.

- Champion and enforce data quality and governance standards across risk-related inventories, enabling confident risk measurement and management decisions.

RISK REPORTING & EXECUTIVE COMMUNICATION

- Build and maintain executive-quality reporting on enterprise risk posture, policy and standards coverage, and the efficacy of regulatory and risk-driven controls.

- Contextualize risk reporting against the organization’s obligations, objectives, and risk appetite — enabling senior leadership and the Board to make well-informed decisions.

- Continuously improve risk metrics, dashboards, and reporting cadences to reflect evolving organizational priorities and stakeholder needs.

EXTERNAL ENGAGEMENT & REPRESENTATION

- Serve as a subject-matter expert on risk governance topics in interactions with regulators (in coordination with Regulatory Compliance), customers, auditors, and other external stakeholders.

- Contribute to the negotiation of contracts, agreements, and licenses with risk management implications, advocating for risk-informed terms and organizational protections.

- Monitor the external and industry landscape to anticipate emerging obligations, translate new requirements into actionable internal frameworks, and proactively position the organization ahead of compliance deadlines.

WHAT WE'RE LOOKING FOR

EXPERIENCE & BACKGROUND

- 7+ years of progressive experience in enterprise risk management, compliance, internal audit, or a closely related governance discipline, with a demonstrated track record as a hands-on practitioner and builder.

- Demonstrated track record of designing, implementing, and maturing enterprise risk management frameworks and control environments at scale.

- Prior experience owning or significantly contributing to policy and standards governance programs, including the lifecycle management of policies, standards, and controls.

- Meaningful exposure to AI governance, responsible AI, or technology risk — with working knowledge of AI risk and ethics frameworks, use-case evaluation methodologies, and emerging AI regulation.

- Experience engaging with external regulators, auditors, or enterprise customers on risk and compliance topics; including participation in regulatory examinations, customer due diligence processes, or contract negotiations.

SKILLS & CAPABILITIES

- Exceptional ability to design and communicate governance structures, risk frameworks, and control architectures to both technical and non-technical audiences.

- Strong analytical and systems-thinking skills, with the ability…