23. AI Governance Engineer
Evidence label: Role family, but less standardized than AI Security Engineer. Current postings at State Street, Deeploy, and Dalio Family Office use the exact title or a combined analyst/engineer variant.
What they do
Turn AI policy, risk, and regulatory requirements into operational tooling and evidence. This is an engineering role when it builds catalogs, lineage, approval gates, policy checks, audit trails, and self-service controls. A governance analyst or policy lead may own interpretation and oversight without building those systems.
Deeploy uses the title for customer implementation, while State Street places it closer to enterprise architecture. The common boundary is control implementation, not one reporting line.
Responsibilities
- Build and operate AI inventories, ownership records, risk classifications, and approval workflows
- Translate policy and regulatory obligations into technical requirements and automated checks
- Capture model, dataset, prompt, evaluation, deployment, and human-approval lineage
- Provide reusable controls and evidence for engineering, risk, legal, compliance, and audit stakeholders
- Monitor control coverage and exceptions instead of treating a policy document as proof of implementation
Distinction from compliance and security
Governance Engineering encodes and operates controls. Legal, compliance, risk, and policy specialists interpret obligations and decide acceptable risk. AI Security Engineering tests and enforces technical security properties. One person may cover several boundaries in a small organization, but the accountabilities should remain explicit.
Entry paths
Governance, risk, and compliance engineer; responsible-AI specialist with software skills; data-governance engineer; platform engineer in a regulated environment; or security engineer focused on control automation.