Director - AI Risk Management

At Moody's, we unite the brightest minds to turn today’s risks into tomorrow’s opportunities. We do this by striving to create an inclusive environment where everyone feels welcome to be who they are—with the freedom to exchange ideas, think innovatively, and listen to each other and customers in meaningful ways. Moody’s is transforming how the world sees risk. As a global leader in ratings and integrated risk assessment, we’re advancing AI to move from insight to action—enabling intelligence that not only understands complexity but responds to it.

We decode risk to unlock opportunity, helping our clients navigate uncertainty with clarity, speed, and confidence.

If you are excited about this opportunity but do not meet every single requirement, please apply! You still may be a great fit for this role or other open roles. We are seeking candidates who model our values: invest in every relationship, lead with curiosity, champion diverse perspectives, turn inputs into actions, and uphold trust through integrity.

• Risk Management Expertise: 7–10+ years of experience in risk management, AI/ML development, audit, or compliance roles, ideally in technology-driven environments.
• AI/ML Technical Depth:
  Hands-on experience with AI/ML development, including LLMs, RAG architectures, and GenAI risk mitigation strategies.
• Engineering
  
  Collaboration:
  
  Ability to engage deeply with technical teams, ask probing questions, and embed governance checkpoints into CI/CD pipelines without slowing delivery.
• Governance Frameworks:
  Familiarity with NIST AI RMF, ISO/IEC 42001, and evolving regulatory landscapes (e.g., EU AI Act).
• Vendor AI Risk Assessment:
  Ability to understand risks and controls of vendor-provided AI tools and evaluate business use case risk assessments and integration into Moody’s products and process workflows.
• Cross-Functional Leadership:
  Exceptional communication and collaboration skills to influence across Legal, Compliance, Cybersecurity, and Product teams.
• Analytical & Scenario Thinking:
  Ability to assess nuanced risks for AI integrations beyond basic cybersecurity and data residency concerns.
  Model Lifecycle Governance:
  Expertise in end-to-end model lifecycle management—development, validation, monitoring, and retirement—aligned with SR 11-7 and internal governance standards.

• Bachelor’s degree in Computer Science, Risk Management, Engineering, Information Systems, or a related discipline.
• Preferred certifications: CRISC, CGRC, AIGC, CIPP/US or CIPP/E, ISO/IEC 42001, PMP or equivalent project management certification.

The Director of Risk Management – AI Governance is a senior member of the Moody’s Analytics Risk Management team, responsible for driving the governance and oversight of AI/ML technologies across a dynamic, development-focused organization. This role is tasked with ensuring that AI adoption within our products and operations is responsible and, safe, and aligned with best practice and enterprise risk standards.
The position will partner closely with engineering and product teams to identify, assess, and mitigate risks associated with AI/ML use cases, embedding governance checkpoints into agile development workflows without slowing innovation. The Director will operationalize AI risk frameworks, translate regulatory and internal requirements into actionable controls, and provide thought leadership on emerging risks in GenAI, LLM architectures, and model lifecycle governance.

• AI Risk Governance Execution:
• Oversee day-to-day governance of AI/ML risk across multiple business units.
• Maintain AI use case and model inventory, ensuring lifecycle compliance and risk determinations.
• Risk Assessment:
• Conduct and document risk assessments covering fairness, bias, explainability, security, and resilience.
• Translate enterprise AI risk policies into practical procedures, templates, and workflows.
• Engineering & Product Partnership:
• Collaborate with technical teams to embed governance checkpoints into development pipelines.
• Evaluate technical implementations (e.g., RAG architectures, prompt injection defenses, output monitoring).
• Vendor Tool Governance:
• Assess risks…