As the AI & Data Privacy Line 2 Risk Leader, you will be responsible for establishing and leading the enterprise-wide risk management strategy for Artificial Intelligence (AI), Machine Learning (ML), and data-driven technologies. This role ensures that AI systems and data practices are ethical, secure, compliant, and aligned with privacy & regulatory expectations and values of MPMS.
The role will work cross-functionally with technology, legal, L1 risk teams, data science, and business teams to identify, assess, and mitigate risks associated with AI models, data privacy & governance, and emerging technologies.
This role is ideal for a seasoned risk professional, will contribute to our overall AI governance strategy, data privacy policies & procedures, executing & enabling a future fit risk management practise in both domains to enable our client & customer ambitions.
Key Accountabilities and main responsibilities
Strategic Focus
- Design and implementation of enterprise-wide AI Policy and Data Risk Governance Model.
- Drive adherence and execution of the AI Risk Assessments, to determine the adequacy & effectiveness of their internal controls.
- Design educational workshops and provide consultation to senior management and key stakeholders for ethical use of AI and Data.
- Drive capability uplift across Senior Leadership team in line with ongoing improvements in risk culture.
Operational Management
- Develop and implement a comprehensive AI risk management framework.
- Ensure adherence to AI principles for every valid AI use case, providing L2 oversight and assurance on the AI Risk & Information Security Assessments conducted by the business teams.
- Define risk appetite and controls for AI/ML systems across their lifecycle (design, training, deployment, monitoring).
- Provide subject matter inputs to support the effective management of AI risks.
- Lead AI model validation, assurance & approval processes.
- Develop and maintain the organization’s data quality, privacy framework, lineage, policies, and procedures for ethical use.
- Oversee data governance programs and ensure alignment with regulatory requirements (e.g., GDPR, PII, CCPA, APRA CPS 234/230).
- Lead privacy risk assessments and data protection impact assessments (DPIAs).
- Monitor third-party data risks and vendor compliance.
- Champion privacy by design and default in technology and business processes.
- Liaise with regulatory authorities and manage responses to inquiries or investigations.
- Lead privacy incident response and breach notification procedures & transparency.
- Develop and deliver privacy training and awareness programs across the organization.
- Provide expert guidance to teams on privacy risks and mitigation strategies.
People Leadership
- Lead a team of L2 AI Risk Manager & Data Privacy Officers managing enterprise-wide risk deliveries of our strategic objectives and goals for both the domains.
- Lead the development and delivery of effective engagement strategies for ERCC & BRCC meetings, town halls, new hire onboarding, and employee training programs, ensuring they resonate with and inspire the team.
- Timely decisions that align with the strategy and vision of the organisation
- Foster strong, influential partnerships with SLT to guide strategic priorities, ensuring alignment with organizational success and driving focus on key initiatives.
- Lead internal and external communication efforts to reinforce key messages and build trust.
- Collaborate with IT, cybersecurity, legal, and business units to align AI risk & data privacy with broader risk and compliance objectives.
- Advise on third-party data sharing, cross-border transfers, and vendor risk
- Working with your sponsor to develop effective and implement as needed risk management plans to minimise the consequence of adverse events
Governance and Risk
- Provide independent Line 2 oversight to ensure robust governance and effective risk management of AI, data privacy, and emerging technology initiatives, aligned with regulatory expectations and organizational risk appetite.
- Establish and maintain strong governance frameworks, enabling proactive identification, assessment, and mitigation of risks while embedding a culture of accountability, transparency, and ethical practices across the enterprise.
Experience & Personal Attributes
- Graduate qualification in any discipline, with relevant tertiary or postgraduate qualifications in IT, Computer Science, or Information Security (desirable but not essential).
- At least 12+ years of experience in technology & security risk management including reasonably deep knowledge and experience in managing AI & Data Risk in Financial Services sector, preferably with investment banking or superannuation industry.
- Professional experience in audit, and/or consulting would be beneficial
- Strong leadership in risk management and compliance frameworks, with deep expertise in Technology, Data, and Information Security risks.
- Preferable certification in CRISC, CISM, CISA, CISSP, ISO 27001 Lead Auditor.
- Knowledge of frameworks such as NIST, AI NIST, PCI DSS, COBIT, CIS, and ISO 27001, 42001 would be an advantage.
- Strong understanding of regulatory standards set out by APRA, EU DORA, UK FCA, PRA, SEBI & HKMA authorities.
- Program management / transformation experience, ideally in digital, data, or AI.
Personal Attributes
- Strategic and outcome focused.
- Comfortable with ambiguity and complexity, able to collaborative & influence
- Passionate about the role of AI & Data in shaping the future of work
- Strong team leadership skills.
- Excellent organisational skills with the ability to coordinate others
- Proficiency in MI & analytics and tools such as Alteryx, Power BI, and Tableau.
