AI Risk & Compliance Analyst

AI Risk & Compliance Analyst At WHOOP, we’re on a mission to unlock human performance and healthspan. Our wearable technology provides personalized insights that help millions of members better understand their bodies and make smarter decisions about training, recovery, and lifestyle. As AI systems play a growing role across our platform, effective governance, risk management, and compliance for AI and associated technologies are critical for safeguarding member data, ensuring regulatory alignment, and enabling secure innovation. We are seeking an AI Risk & Compliance Analyst to partner with Security, Product, Engineering, Legal, and Privacy teams to govern risk and compliance related to AI systems and machine learning integrations. This role will support AI-related risk evaluation, vendor assessments, policy governance, audit coordination, and compliance with emerging AI regulatory frameworks. This is a senior individual contributor role within GRC with broad influence across risk domains and collaboration with technical and business stakeholders. RESPONSIBILITIES: - - Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows - Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into GRC frameworks and translate technical risk into governance requirements - Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks, including ISO/IEC 27001, NIST Cybersecurity Framework, NIST AI Risk Management Framework, EU AI Act, GDPR, and other applicable standards - Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring, control mapping, and remediation tracking - Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls, evidence collection, and follow-up on remediation items - Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external compliance reviews involving AI systems - Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains, explainability requirements, and compliance obligations - Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend analysis, control effectiveness measurements, and key metrics - Monitor emerging AI governance requirements, guidance, and best practices, translating them into GRC program updates and compliance recommendations - Support security incident documentation and post-incident analysis for AI system events, coordinating with Legal and Security teams to ensure appropriate governance response QUALIFICATIONS: - - 6+ years of experience in Governance, Risk & Compliance, including risk assessment, policy development, audit coordination, and third-party risk management - Demonstrated experience performing governance or risk assessments for AI/ML systems, including LLM integrations, model pipelines, AI agents, or data-driven algorithmic systems - Experience translating AI-specific risks (i.e., data poisoning, prompt injection, model misuse, data leakage, explainability gaps) into documented control requirements and governance standards - Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or machine learning service providers - Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 27001, NIST CSF, NIST AI RMF, ISO/IEC 42001, GDPR, PCI DSS, or similar standards - Strong understanding of data governance concepts relevant to AI systems, including training data lineage, data retention, model output handling, and human oversight requirements - Experience supporting regulatory readiness or compliance efforts related to AI systems - Proven ability to collaborate with engineering and security teams to valida ... (truncated, view full listing at source)