Head of Governance, Risk and Compliance

We are hiring a Head of Governance, Risk and Compliance for our Trust and Intelligence organization a strategic leadership role accountable for establishing governance frameworks, managing enterprise risk, and ensuring regulatory and compliance adherence across the company. You will define how we operate responsibly and compliantly while enabling business growth, and you will lead a growing team across compliance, policy, audit, and emerging technology governance. This includes establishing governance frameworks for agentic AI systems ensuring responsible development, security, transparency and regulatory compliance as autonomous agents become core to our product strategy.

Role overview

As Head of Governance, Risk and Compliance, you own the governance, risk and compliance framework across the entire organization. You are accountable for ensuring that Product and Technology, Finance, Operations, Customer Success and all business functions operate in compliance with applicable laws, regulations, contractual obligations, industry standards and internal policies.

You serve as the central point of accountability for compliance risk, regulatory relationships, audit management, risk governance, policy frameworks, and board-level reporting. This includes establishing governance frameworks for emerging technologies, particularly agentic AI systems, to ensure responsible development, security, transparency, auditability, and regulatory adherence.

Your mandate is to transform compliance from a reactive, audit-driven function into a proactive, integrated capability that embeds compliance into business processes, enables informed risk-taking, and positions governance as a strategic enabler rather than a constraint. You will work closely with Product and Technology, Finance, Security Operations, Observability, AI/ML teams, Legal, Human Resources, and executive leadership. Success requires balancing rigorous oversight with business enablement, and building cross-functional ownership of compliance responsibilities across the organization.

Duties and accountabilities

Regulatory compliance and risk management

•
Maintain current understanding of applicable regulations across all business functions (data protection, privacy, financial, industry-specific, contractual obligations) and monitor regulatory changes to anticipate impact.

•
Conduct regulatory gap assessments, compliance audits and controls testing to identify compliance risks and remediation needs.

•
Develop compliance roadmaps with clear implementation timelines and success criteria for achieving and maintaining regulatory adherence.

•
Manage regulatory relationships and lead audit coordination, audit preparation, and audit response across all regulatory bodies.

•
Establish incident response and breach of notification procedures; lead response to compliance incidents and regulatory violations.

Enterprise risk governance and assessment

•
Define risk governance frameworks, risk appetite statements and tolerance thresholds aligned with business strategy and stakeholder expectations.

•
Lead enterprise risk assessments across Product, Technology, Finance, Operations and Customer Success to identify strategic, operational, financial, technology and emerging technology risks.

•
Establish risk governance forums with business leaders to review, prioritize and escalate material risks to executive and board leadership.

•
Own risk reporting to Board and executive leadership, with clear risk status, trends and mitigation progress.

•
Drive risk mitigation initiatives and track remediation of identified risks through to closure.

Policy, governance and control framework

•
Develop, maintain and communicate organizational policies covering data protection, privacy, security, financial, operational and conduct requirements.

•
Establish control frameworks, control standards and control testing procedures aligned with regulatory and business requirements.

•
Define governance forums, decision authority, escalation procedures and approval workflows for compliance-related decisions.

•
Monitor compliance with organizational policies through assessments, audits and exception management.

•
Manage policy exceptions and waivers with clear approval authority, risk assessment and remediation planning.

Agentic AI and emerging technology governance

•
Establish governance frameworks and development standards for agentic AI systems, including responsible AI principles, transparency and auditability requirements.

•
Monitor emerging AI regulations (EU AI Act, sector-specific AI requirements) and anticipate regulatory impact on agent development roadmaps.

•
Partner with Product and Technology to establish agent security controls, addressing prompt injection, data exposure, unintended behavior and hallucination risks.

•
Define audit and observability requirements for agentic systems, including decision logging, behavior monitoring and explainability standards.

•
Conduct risk assessments of high-risk agent use cases; identify potential harms and mitigation strategies before deployment.

•
Establish agent development gates and approval processes for autonomous agent deployments; maintain emerging technology risk registry.

Compliance enablement and culture

•
Build compliance capacity across the organization through training, guidance, and compliance support.

•
Partner with Product and Technology to embed compliance and emerging technology governance requirements into product roadmaps and architecture decisions.

•
Provide trusted compliance advice to business leaders on regulatory implications of new products, partnerships, business models, and agent deployments.

•
Drive a compliance culture where ownership is distributed across the organization, not siloed in compliance; position governance as business enablement.

Regulatory compliance and risk management

•
Maintain current understanding of applicable regulations across all business functions (data protection, privacy, financial, industry-specific, contractual obligations) and monitor regulatory changes to anticipate impact.

•
Conduct regulatory gap assessments, compliance audits and controls testing to identify compliance risks and remediation needs.

•
Develop compliance roadmaps with clear implementation timelines and success criteria for achieving and maintaining regulatory adherence.

•
Manage regulatory relationships and lead audit coordination, audit preparation and audit response across all regulatory bodies.

•
Establish incident response and breach notification procedures; lead response to compliance incidents and regulatory violations.

Enterprise risk governance and assessment

•
Define risk governance frameworks, risk appetite statements and tolerance thresholds aligned with business strategy and stakeholder expectations.

•
Lead enterprise risk assessments across Product, Technology, Finance, Operations and Customer Success to identify strategic, operational, financial, technology and emerging technology risks.

•
Establish risk governance forums with business leaders to review, prioritize, and escalate material risks to executive and board leadership.

•
Own risk reporting to Board and executive leadership, with clear risk status, trends and mitigation progress.

•
Drive risk mitigation initiatives and track remediation of identified risks through closure.

Policy, governance and control framework

•
Develop, maintain and communicate organizational policies covering data protection, privacy, security, financial, operational and conduct requirements.

•
Establish control frameworks, control standards, and control testing procedures aligned with regulatory and business requirements.

•
Define governance forums, decision authority, escalation procedures and approval of workflows for compliance-related decisions.

•
Monitor compliance with organizational policies through assessments, audits, and exception management.

•
Manage policy exceptions and waivers with clear approval of authority, risk assessment, and remediation planning.

Agentic AI and emerging technology governance

•
Establish governance frameworks and development standards for agentic AI systems, including responsible AI principles, transparency and auditability requirements.

•
Monitor emerging AI regulations (EU AI Act, sector-specific AI requirements) and anticipate regulatory impact on agent development roadmaps.

•
Partner with Product and Technology to establish agent security controls, addressing prompt injection, data exposure, unintended behavior and hallucination risks.

•
Define audit and observability requirements for agentic systems, including decision logging, behavior monitoring and explainability standards.

•
Conduct risk assessments of high-risk agent use cases; identify potential harms and mitigation strategies before deployment.

•
Establish agent development gates and approval processes for autonomous agent deployments; maintain emerging technology risk registry.

Compliance enablement and culture

•
Build compliance capacity across the organization through training, guidance, and compliance support.

•
Partner with Product and Technology to embed compliance and emerging technology governance requirements into product roadmaps and architecture decisions.

•
Provide trusted compliance advice to business leaders on regulatory implications of new products, partnerships, business models, and agent deployments.

•
Drive a compliance culture where ownership is distributed across the organization, not siloed in compliance; position governance as business enablement.

What success looks like

• Compliance and regulatory requirements are met through real controls and proactive management, not last-minute scrambles or findings during audits.
• Risk governance frameworks are transparent, understood, and used by business leaders to make informed decisions about risk and opportunity.
• Agentic AI systems are governed with clear standards for responsible development, security, transparency and auditability; agents deploy with confidence and customer trust.
• Compliance ownership is distributed across the organization; business leaders view GRC as a trusted partner and enabler, not a blocker.
• Business leaders proactively raise compliance and risk questions, rather than waiting for GRC to identify issues.
• Regulatory and customer confidence is strong; audit results reflect an organization operating with integrity and control.

Required skills and experience

• Proven experience in governance, risk management, compliance, audit, legal or regulatory affairs in regulated or high-compliance industries.

• Proven track record establishing and leading GRC programs at enterprise scale, including regulatory compliance, risk management and internal controls.

• Deep expertise in data protection and privacy regulations (GDPR, CCPA) and experience with compliance certifications (SOC 2, ISO 27001, etc.).

• Strong background in risk assessment, risk modeling and enterprise risk governance frameworks.

• Demonstrated experience managing regulatory audits, audit preparation, remediation tracking and regulatory relationships.

• Experience leading and developing teams across compliance, policy, audit and risk management functions.

• Familiarity with emerging technology governance, AI/ML governance frameworks and understanding of evolving AI regulations.

• Strong communication and influence skills; ability to translate regulatory requirements and risk concepts for business stakeholders and executives.

• Demonstrated ability to balance risk management and business enablement, positioning compliance as a strategic advantage rather than a constraint.

Scope and expectations

• Leadership role accountable for governance, risk and compliance strategy across the entire organization.

• Covers regulatory compliance, enterprise risk governance, policy frameworks, control architecture, and emerging technology (agentic AI) governance — not one domain or function.

• Expected to establish standards, convene cross-functional forums and drive compliance decisions with authority; reports directly to VP of Trust and Intelligence.

• Expected to raise and escalate risks even when inconvenient or challenging to business plans.

• People-management role with responsibility for building and developing the GRC team (5-8+ people) across compliance, policy, audit and emerging technology governance specialties.

Nice to have

• Experience in a software, technology, or SaaS company with significant regulatory or compliance obligations.

• Direct experience leading compliance programs supporting SOC 2, FedRAMP, ISO 27001, or similar certifications.

• Familiarity with EU cybersecurity and data-protection regulations relevant to global SaaS/cloud vendors.

• Demonstrated track record securing Board-level support and investment for compliance and governance initiatives.

• Experience managing compliance for AI/ML or generative AI products and services.

• Relevant advanced certifications (e.g., CCSA, CGAP, or equivalent) — not mandatory.

Qualifications

Core required qualifications

• Demonstrated experience designing and implementing GRC programs across regulatory compliance, risk management and internal controls.

• Working knowledge of major regulatory frameworks and standards applicable to software/SaaS (GDPR, CCPA, SOC 2, ISO 27001, FedRAMP, NIST).

• Practical experience conducting and managing regulatory audits, including remediation and control validation.

• Strong risk assessment and risk governance experience; familiarity with enterprise risk frameworks and risk modeling.

• Proven ability to develop and communicate compliance policies, standards and procedures clearly to technical and non-technical audiences.

• Experience leading teams and developing talent in compliance, audit, policy and risk management functions.

• Strong communication and stakeholder management skills; demonstrated ability to influence across organizational boundaries without formal authority over all functions.

Preferred qualifications

• 10+ years of experience in governance, risk, compliance, audit or regulatory roles in regulated industries (financial services, healthcare, public sector, enterprise SaaS).

• Track record leading GRC transformations; moving organizations from reactive to proactive compliance and governance.

• Demonstrated success managing complex multi-stakeholder compliance programs (regulatory bodies, boards, auditors, business leaders, customers).

• Direct experience with emerging technology governance, AI/ML governance frameworks or managing governance of novel/rapidly evolving technologies.

• Experience building and scaling high-performing teams in compliance and risk management; demonstrated talent development success.

• Proven ability to secure executive and Board support for compliance initiatives; experience communicating technical compliance concepts to non-technical audiences.

IFS is a billion-dollar revenue company with 7000+ employees on all continents. Our leading AI technology is the backbone of our award-winning enterprise software solutions, enabling our customers to be their best when it really matters–at the Moment of Service™. Our commitment to internal AI adoption has allowed us to stay at the forefront of technological advancements, ensuring our colleagues can unlock their creativity and productivity, and our solutions are always cutting-edge.

At IFS, we’re flexible, we’re innovative, and we’re focused not only on how we can engage with our customers but on how we can make a real change and have a worldwide impact. We help solve some of society’s greatest challenges, fostering a better future through our agility, collaboration, and trust.

We celebrate diversity and understand our responsibility to reflect the diverse world we work in. We are committed to promoting an inclusive workforce that fully represents the many different cultures, backgrounds, and viewpoints of our customers, our partners, and our communities. As a truly international company serving people from around the globe, we realize that our success is tantamount to the respect we have for those different points of view.

By joining our team, you will have the opportunity to be part of a global, diverse environment; you will be joining a winning team with a commitment to sustainability; and a company where we get things done so that you can make a positive impact on the world.

We’re looking for innovative and original thinkers to work in an environment where you can #MakeYourMoment so that we can help others make theirs. With the power of our AI-driven solutions, we empower our team to change the status quo and make a real difference.

If you want to change the status quo, we’ll help you make your moment. Join Team Purple. Join IFS.

We embrace flexibility and hybrid work opportunities to support diverse needs and lifestyles, while also valuing inclusive workplace experiences. By fostering a sense of community, we drive innovation, strengthen connections, and nurture belonging. Our commitment ensures you can work in a way that suits you best, while also engaging with colleagues to share ideas and build meaningful relationships.