At WHOOP, we're on a mission to unlock and inspire performance for life.

WHOOP is seeking a Governance, Risk, and Compliance Analyst II, to lead the day-to-day operation and support the ongoing risk management program at GRC in a fast-paced, high-growth environment. This role is responsible for operations of GRC initiatives - including but not limited to structured cybersecurity and AI risk assessments, exceptions management,

SDLC reviews and security compliance process ownership. The role will partner closely with Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk, and strengthen operational resilience.

The ideal candidate combines strong analytical thinking, critical risk mind-set, familiarity with AI governance and has the ability to communicate complex risk scenarios clearly to both technical and non-technical stakeholders.

RESPONSIBILITIES

Lead governance, risk assessment, and compliance activities specific to AI/ML systems,

LLM integrations, AI agents, and retrieval-augmented workflows

Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into

GRC frameworks and translate technical risk into governance requirements

Develop, maintain, and refine AI risk and compliance controls aligned with relevant

frameworks, including ISO/IEC 42001, NIST Cybersecurity Framework, NIST AI Risk

Management Framework, EU AI Act, GDPR, and other applicable standard

Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI

tools, including third-party risk scoring, control mapping, and remediation tracking

Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring

documented controls, evidence collection, and follow-up on remediation items

Support audit activities, capturing evidence and coordinating cross-functional

stakeholders for internal and external compliance reviews involving AI systems

Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI

risk domains, explainability requirements, and compliance obligations

Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend

analysis, control effectiveness measurements, and key metrics

Monitor emerging AI governance requirements, guidance, and best practices, translating

them into GRC program updates and compliance recommendations

Support security incident documentation and post-incident analysis for AI system events,

coordinating with Legal and Security teams to ensure appropriate governance response

QUALIFICATIONS

6+ years of experience in Governance, Risk & Compliance, including risk assessment,

policy development, audit coordination, and third-party risk management

Demonstrated experience performing governance or risk assessments for AI/ML systems,

including LLM integrations, model pipelines, AI agents, or data-driven algorithmic systems

Experience translating AI-specific risks (i.e., data poisoning, prompt injection, model

misuse, data leakage, explainability gaps) into documented control requirements and

governance standards

Hands-on experience conducting third-party risk assessments for AI vendors, LLM

platforms, AI APIs, or machine learning service providers

Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001,

NIST CSF, NIST AI RMF, ISO/IEC 42001, GDPR, PCI DSS, or similar standards

Strong understanding of data governance concepts relevant to AI systems, including

training data lineage, data retention, model output handling, and human oversight

requirements

Experience supporting regulatory readiness or compliance efforts related to AI systems

Proven ability to collaborate with engineering and security teams to validate control

implementation and remediation

Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance,

or a related field

This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.