Who Should Own AI Security Governance, and What Background Does That Job Take?

What Does an AI Security Governance Officer Do in the First Ninety Days?

A product manager forwards a vendor contract at 4pm on a Friday. The tool ships an agent that reads the ticketing system and drafts customer replies. Legal wants a risk opinion by Monday, security has never seen the model, and nobody can say which other agents already hold that data. The first ninety days of this role are spent making that question answerable.

The first artifact is an inventory: every model, agent, copilot and embedded feature in use, with the data each one touches, the vendor behind it, the business owner, and whether a human reviews its output before anything leaves the building. Shadow usage is the interesting half. The inventory that only lists procured tools is a list of what finance paid for, not a list of what employees run.

The second artifact is the obligation map. Regulation (EU) 2024/1689 sets requirements on high-risk systems around technical documentation, record-keeping and human oversight, and deployer duties sit alongside provider duties ³. A sector regulator, a state law or a customer contract may bind you before the EU text does. This is a place to name the jurisdiction, name the date, and check the mapping with counsel rather than treat a blog summary as advice.

The third is the loop that keeps the first two honest: an acceptable-use policy people can actually follow, a vendor AI review that runs before the contract rather than after, and a path from red-team and incident findings into a risk register the board reads. Findings that stop at a slide deck are the failure mode. The officer's real output is a change in what ships.

The boundary worth drawing at the offer stage: this person governs, and a separate engineer builds the guardrails. If the job description asks for both, read what an AI security engineer actually owns before writing the requisition, because merging them produces a person who reviews their own work.

Recruit AI Security Governance From Safety Investigators, Not Policy Writers

The reliable feeder is security GRC with real technical depth: someone who ran a SOC 2 or ISO 27001 program, sat in vendor security reviews, and has argued a control down to something engineers would adopt. Third-party risk leads and internal auditors from regulated industries are the second stream. Both bring the habit this job runs on, which is asking for evidence rather than assurances.

The unexpected backgrounds are often stronger. Clinical safety officers and aviation safety investigators already think in failure modes, near misses and mandatory reporting, and they do not confuse a policy with a barrier. Privacy program managers who came up through DPIAs can read a regulation and produce a decision. Site reliability engineers who ran incident command bring blameless postmortems and a working sense of how systems fail under load. Machine learning engineers who moved into safety work bring the one thing most GRC candidates lack, which is the ability to argue with the platform team about evals.

The tells separating real from performed take about ten minutes to surface, and the Friday vendor contract is a serviceable prop for all of them. Hand it over. Ask what they would cut from an acceptable-use policy to make room for a tool like this, and a real one names a clause that got ignored somewhere else and explains what replaced it. Ask what they would have told legal on Monday with only what was knowable on Friday, and whether they would reverse that answer now, and a real one has a decision they would take back and can say what evidence would have changed it. Then ask what happens if the product team switches the agent on over the weekend without waiting. Performed governance escalates to a committee. Real governance names the first three questions, the containment step, and the point at which the launch stops.

One more filter: ask what they think is overrated. A candidate who cannot criticize any part of the current AI risk orthodoxy has not formed a position, only absorbed one. That matters here more than in most roles, because the job is largely holding a line against people who outrank the person holding it.

How Did the Candidate Learn AI Security Governance by Doing It?

The practice behind the skill is unglamorous and easy to check. Strong candidates have sat with the models rather than around them. They have run a jailbreak set against their own company's assistant, watched an agent take an action nobody authorized, and written up what happened with timestamps. Governance written by someone who has never made a model misbehave reads like a summary of other people's documents.

Ask how they use an assistant in their own work, and listen for the checking. The strong answer is specific about division of labor: the model drafts the control mapping or the first pass of a vendor questionnaire, and the person verifies every citation against the primary text because the model will produce a plausible article number that does not exist. Candidates who describe AI as a research shortcut without describing a verification step are telling you what their risk register will look like.

Look for evidence they have built an eval rather than requested one. That can be small: a set of twenty prompts that a support agent must refuse, run before and after a model version change, with results kept. It shows they understand that a control on a probabilistic system is measured, not asserted. The same instinct shows up in how they talk about adversarial testing of agentic systems, which they should treat as an input they consume rather than a service they buy once a year.

The last practice tell is writing. This job produces memos that executives read under time pressure. Ask for a one-page risk opinion on the Friday contract, written during the process rather than in advance. What you learn is whether they can hold a position, state what would change it, and say plainly what they do not know.

Where Do AI Security Governance Candidates Come From, and What Closes One?

They cluster in a small number of visible places. The IAPP community around the AIGP credential is the densest pool, and certification holders reported a US median of $182,000 in one 2026 salary report ¹. Contributors to the OWASP Top 10 for LLM Applications, participants in Cloud Security Alliance AI safety working groups, and people who show up at DEF CON's AI Village or a regional BSides are self-selecting for the technical half of the job.

The adjacent roles worth sourcing from are third-party risk lead, privacy program manager, security architect and lead internal auditor. Feeder employers are banks, insurers, health systems, the big consulting risk practices, and trust and safety or trust-and-compliance teams inside cloud and SaaS vendors. Consultants leaving the big four are a real stream, though the ones to hire are the ones who left because they wanted to own an outcome rather than deliver a report.

What closes them is authority, in writing. This candidate has usually been burned by a role where governance meant producing artifacts nobody read. They want the reporting line named, the veto documented, a budget for tooling and testing that is not borrowed from another team, and direct access to the engineers running the platform. Ask what they need to be effective and they will tell you exactly which of these they lost last time.

What kills the offer is equally predictable: a reporting line into communications or a compliance function with no security engineering access, a title without a decision right, an interview panel where nobody can say who currently owns AI risk, and any signal that the company wants a name on the org chart to show an auditor. Pay close, but do not expect money to fix a structural answer. If the mandate is genuinely broader than security, hire an AI governance lead and let this role stay technical.

What Should You Pay an AI Security Governance Officer, and Where Does the Work Sit?

As of mid-2026 there is no long-running public wage series for this exact title, so anchor on the closest published bands. VerifyWise's 2026 AI governance salary report puts US manager and mid-career AI governance base pay at roughly $140,000 to $218,000, with a US median of $182,000 among AIGP certification holders ¹. Senior roles owning security and regulatory exposure together price above that band, and equity varies more than base.

The demand side explains the pressure. The same report cites LinkedIn data putting AI governance demand up 150 percent year over year, with AI compliance officer postings up roughly 45 percent as EU obligations approached ¹. The World Economic Forum's 2025 outlook placed Security Management Specialists among its fastest-growing jobs at about 53 percent growth to 2030 ², and McKinsey found 13 percent of organizations had hired AI compliance specialists in the previous twelve months ⁴. A first hire made now is competing against a field that is still forming its bands.

On location, most of this work is remote-friendly because its outputs are documents, reviews and decisions. The pull toward a desk is specific rather than general: regulated environments with restricted data enclaves, defense or classified work, incident weeks when the person needs to be in the room, and the first quarter of the job, when the inventory gets built by walking to people rather than emailing them. A common shape is hybrid with two anchored days, plus travel for regulator and customer audits.

One budget decision remains. A consultant is the right call when the need is a one-time gap assessment against a named framework and a deadline. An employee is the right call the moment the answer has to be maintained, because the inventory decays in weeks and no retainer keeps it current. Friday's contract arrives again in six weeks under a different vendor's name, and somebody has to be there for it. If the trigger for this hire was a customer questionnaire rather than an operating risk, buy the assessment and revisit the headcount in two quarters.

Read the evidence >