AI Governance, Security & Compliance Manager

POSITION SUMMARY

The AI Governance, Security & Compliance Manager is responsible for leading Hagadone Corporation's enterprise AI governance, cybersecurity governance, risk management, and compliance programs. This strategic leadership role drives the responsible adoption of artificial intelligence across the organization by establishing governance frameworks, policies, risk controls, and best practices that enable innovation while protecting business operations, data, and regulatory compliance. Partnering with executive leadership, IT, Human Resources, Finance, Legal, and third-party vendors, the AI Governance, Security & Compliance Manager develops and maintains security and compliance programs, including PCI DSS compliance, risk assessments, policy management, audit coordination, and regulatory readiness. The role serves as a key advisor on emerging AI technologies and information security risks, translating complex technical and regulatory requirements into practical, sustainable, and auditable business processes. This is a governance and leadership position rather than a hands-on systems administration or security operations role. The position reports directly to the Chief Information Officer (CIO) of Hagadone Corporation and is based on-site at the company's headquarters in Coeur d'Alene, Idaho. Regular in-person attendance is required.

ESSENTIAL DUTIES AND RESPONSIBILITIES

AI Strategy, Leadership and Governance

• Champion and lead the organization's AI adoption strategy, partnering with senior leadership to identify, evaluate, and prioritize AI tools and initiatives that deliver business value.
• Build and own the company's AI governance framework, including policies, standards, risk assessment processes, and decision-making workflows for AI tool approval and ongoing oversight.
• Conduct AI risk assessments for proposed and in-use AI technologies, evaluating data privacy, confidentiality, security, accuracy, vendor risk, regulatory exposure, and ethical considerations.
• Establish and maintain an AI tool registry and approval process, ensuring all AI systems used across the organization are vetted, documented, and monitored.
• Drive AI literacy and readiness across the organization - develop training programs, change management plans, and communications that help employees understand and responsibly use AI tools.
• Define and communicate guardrails, acceptable use standards, and data classification guidance specific to AI usage (e.g., what data may be entered into generative AI tools, when human review is required, how AI outputs should be validated).
• Stay current on the evolving AI regulatory and risk landscape, including emerging frameworks and proactively surface relevant considerations to leadership.
• Serve as the organization's internal AI consultant advising business units on responsible AI integration and helping teams move from experimentation to scalable, governed adoption.
• Partner with vendors, technology partners, and external advisors to evaluate AI platform capabilities, contractual safeguards, and shared responsibility obligations.

GOVERNANCE, RISK & COMPLIANCE

SECURITY COMPLIANCE PROGRAM

• Lead the development, implementation, and ongoing maintenance of the organization's information security governance, risk, and compliance program.
• Coordinate and manage the company's PCI DSS process, including evidence collection, control validation, remediation tracking, and year-round readiness activities.
• Support and coordinate cyber insurance security requirements, questionnaires, renewals, and control attestations.
• Assist with financial, cybersecurity, regulatory, and third-party audit requests, including gathering documentation, coordinating responses, and tracking follow-up items to closure.
• Maintain an organized repository of policies, standards, procedures, control documentation, evidence, exceptions, and remediation plans.
• Identify control gaps and work with internal stakeholders to develop, document, and track corrective actions.
• Manage policy exceptions, risk acceptances, and compensating control documentation in alignment with business and security needs.
• Monitor evolving regulatory, contractual, insurance, and industry requirements and help ensure the organization remains aligned.

POLICY AND PROCEDURE MANAGEMENT

• Develop, maintain, and periodically review information security and AI governance policies, standards, procedures, and guidelines.
• Ensure policies are practical, current, and aligned with operational practices, business objectives, and applicable frameworks (PCI DSS, NIST CSF, NIST AI RMF, etc.).
• Collaborate with HR, Legal, Finance, IT, and operational teams to integrate policy requirements into company processes and employee expectations.
• Support policy communication, employee acknowledgment processes, and ongoing updates as systems, risks, AI tools, and business practices evolve.

SECURITY PROGRAM COORDINATION

• Partner with IT and other stakeholders to oversee the documentation and governance of core security domains, including access control, vulnerability management, logging and monitoring, incident response, backup and disaster recovery, change management, endpoint protection, and third-party/vendor risk.
• Review remediation progress for vulnerabilities, audit findings, and control gaps, helping prioritize actions based on risk and business impact.
• Support incident response and disaster recovery readiness through documentation review, lessons learned tracking, tabletop exercises, and recovery planning coordination.
• Prepare reports, dashboards, and leadership briefings on compliance status, key risks, remediation progress, AI governance status, and program maturity.

SECURITY AWARENESS AND COMMUNICATIONS

• Coordinate and continuously improve the company's security awareness and education program, including AI-specific training content.
• Develop employee guidance related to phishing, acceptable use, data handling, password hygiene, third-party risks, AI usage, and other security topics.
• Promote a culture of security awareness and responsible technology use, including thoughtful AI adoption, across the organization.

QUALIFICATIONS AND REQUIREMENTS

REQUIRED:

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Business Technology, Risk Management, or a related field; equivalent practical experience will be considered.
• 4+ years of experience in information security compliance, GRC, cybersecurity governance, IT audit, or security program management.
• Demonstrated experience or strong working familiarity with AI technologies, generative AI tools, and AI governance concepts, including risk, data privacy, acceptable use, and responsible adoption.
• Experience supporting or leading PCI DSS assessments, audit readiness, or control validation efforts.
• Experience developing and maintaining security policies, procedures, standards, and documentation.
• Strong verbal and written communication skills, including the ability to present complex topics clearly to executive and non-technical audiences.
• Strong organizational skills with the ability to manage multiple workstreams and priorities simultaneously.
• Working knowledge of common IT and security control domains: identity and access management, vulnerability management, incident response, endpoint and network security, and third-party/vendor risk.

PREFERRED:

• Hands-on experience evaluating, piloting, or governing AI tools (e.g., Microsoft Copilot, ChatGPT/OpenAI, Google Gemini, or similar platforms) in a business environment.
• Experience with one or more additional security frameworks: NIST CSF, CIS Controls, ISO 27001, SOC 2, HIPAA, or SOX IT controls.
• Experience working in environments subject to PCI DSS, cyber insurance controls, financial audit requirements, or other formal compliance obligations.
• Experience helping establish or mature a compliance, governance, or AI governance function in a growing organization.
• Experience working with external assessors, auditors, insurers, AI vendors, or technology consultants.

PREFERRED CERTIFICATIONS:

One or more of the following is preferred:

• CISA - Certified Information Systems Auditor
• CRISC - Certified in Risk and Information Systems Control
• CISM - Certified Information Security Manager
• CISSP - Certified Information Systems Security Professional
• PCI ISA - Internal Security Assessor
• PCIP - PCI Professional
• ISO 27001 Lead Implementer or Lead Auditor