AI Security Governance Principal

About Invesco

As one of the world’s leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you're looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco.

Your Role

We are seeking an experienced AI Security Governance Lead – Principal to establish and operate the AI security governance capability as a hands-on individual contributor. The role combines governance leadership with direct analyst execution, including AI use-case intake, inventory management, risk assessments, architecture and control reviews, governance documentation, evidence collection, issue tracking, metrics, and committee support. The individual will build structure in an evolving environment, independently manage the day-to-day workload, and influence decisions across all levels of the organization.

You Will Be Responsible For:

Governance Operations and Delivery

• Own and operate the end-to-end AI security governance workflow, from use-case intake and risk classification through review, approval, remediation, deployment, periodic reassessment, and retirement.
• Create and maintain the enterprise inventory of AI use cases, models, agents, platforms, vendors, owners, data classifications, deployment environments, approval status, and residual risks.
• Configure and administer intake forms, risk questionnaires, decision criteria, approval workflows, risk registers, exception records, and remediation trackers using Jira, Confluence, GRC platforms, or similar tools.
• Manage the daily review queue, prioritize requests based on risk and business need, monitor service levels, and follow up directly with stakeholders to resolve gaps and overdue actions.
• Lead security deliverables within the AI Foundations program from requirements definition through implementation and operationalization, including roadmaps, milestones, procedures, metrics, and sustainable ownership.

AI Model Risk Review

• Perform AI security and risk assessments in alignment with the enterprise model risk framework, and automate repeatable portions of the assessment process where practical.
• Assess foundation models, local large language models, AI agents, AI platforms, retrieval-augmented generation solutions, and third-party AI services across their lifecycle.
• Review solution architectures, data flows, prompts, integrations, identities, permissions, APIs, plugins, tool access, logging, monitoring, and agent actions to identify security and control weaknesses.
• Execute structured control reviews and coordinate specialized testing for prompt injection, sensitive data exposure, insecure output handling, excessive agency, hallucination, jailbreaking, supply-chain compromise, bias, and misalignment.
• Define security requirements and compensating controls for AI systems of all types and levels of criticality; document findings, risk decisions, exceptions, control owners, and residual risk.

Shadow AI Risk Management

• Establish and operate controls for detecting, assessing, and governing shadow AI, including unauthorized models, applications, browser services, plugins, agents, and developer tools.
• Analyze outputs from AI discovery, data loss prevention, cloud access security broker, SaaS security, cloud security, identity, and monitoring tools to identify unmanaged AI usage and prioritize investigation.
• Define and maintain governance and security requirements for Model Context Protocol usage, including detection, restriction, approval, authentication, authorization, logging, and exception processes.
• Investigate identified use cases, document risk and business context, recommend approved alternatives or compensating controls, and track remediation through closure.
• Produce recurring dashboards that provide leadership with visibility into AI adoption, unauthorized usage, review volumes, aging actions, exceptions, control effectiveness, and material risk trends.

 Threat and Regulatory Monitoring

• Monitor the evolving AI threat landscape, including offensive AI use, AI supply-chain risks, and attacks against AI-enabled applications provided by critical suppliers.
• Assess the relevance and potential impact of emerging threats; document findings and update controls, standards, questionnaires, and monitoring requirements accordingly.
• Track relevant regulatory, industry, and supervisory developments affecting AI security and governance, and translate them into specific actions and accountable owners.
• Maintain practical control mappings to the NIST AI Risk Management Framework, ISO/IEC 42001, OWASP guidance, and applicable cybersecurity and model risk frameworks.

The Experience you Bring:

• 10 or more years of experience in cybersecurity, technology risk, security architecture, AI governance, model risk, or related technology disciplines.
• Demonstrated experience personally designing, implementing, and operating enterprise security or technology-risk governance processes in a complex, regulated environment.
• Hands-on experience performing risk assessments, reviewing technical architectures and data flows, documenting findings, defining
• Strong understanding of generative AI, foundation models, vector databases, AI agents, retrieval-augmented generation, prompt engineering, and modern AI application architectures.
• Working knowledge of AI-specific risks, including prompt injection, sensitive information disclosure, insecure output handling, excessive agency, accountability gaps, jailbreaking, and AI supply-chain compromise.
• Experience maintaining inventories, risk registers, control mappings, exceptions, governance records, dashboards, and audit-ready evidence using Jira, Confluence, GRC platforms, spreadsheets, or comparable tools.
• Experience facilitating cross-functional governance reviews and influencing decisions involving security, technology, risk, legal, compliance, privacy, data, and business stakeholders.
• Experience with AI platforms such as Azure AI, Microsoft Copilot, Amazon Bedrock, Snowflake Cortex, or comparable technologies.
• Familiarity with AI security and governance frameworks, including the NIST AI Risk Management Framework, ISO/IEC 42001, and OWASP guidance for AI platforms and applications.
• Familiarity with cloud security, data protection, identity and access management, application security, API security, software supply-chain security, and security monitoring.
• Experience with AI discovery, SaaS security posture management, data loss prevention, cloud access security broker, or other capabilities relevant to detecting and controlling shadow AI.
• Relevant certifications or advanced training in cybersecurity, cloud security, risk management, artificial intelligence, machine learning, or privacy.

Full Time / Part Time

Full time

Worker Type

Employee

Job Exempt (Yes / No)

Yes

Workplace Model

Pursuant to Invesco’s Workplace Policy, employees are expected to comply with the firm’s most current workplace model, which as of October 1, 2025, includes spending at least four full days each week working in an Invesco office. This reflects our belief that spending time together in the office helps us build stronger relationships, collaborate more easily, and support each other’s growth and development.

The above information on this description has been designed to indicate the general nature and level of work performed by employees within this role. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job. The job holder may be required to perform other duties as deemed appropriate by their manager from time to time.

Invesco's culture of inclusivity and its commitment to diversity in the workplace are demonstrated through our people practices. We are proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, creed, color, religion, sex, gender, gender identity, sexual orientation, marital status, national origin, citizenship status, disability, age, or veteran status. Our equal opportunity employment efforts comply with all applicable U.S. state and federal laws governing non-discrimination in employment.