About the Role

AlphaSense is building the function that governs AI across the enterprise: the product, engineering workflows, business processes, third-party services, and a fast-growing footprint of autonomous agents and MCP connectors. That function has one hard obligation it cannot delegate. When the board asks how much AI risk we carry, or an ISO 42001 auditor asks where a control-coverage number came from, there has to be a defensible answer with a traceable path back to a source system.

You will build the data layer that makes that answer possible.

This is an analytics engineering role, not a dashboard role. You will own the governance data model, the pipelines that populate it, the data quality and lineage that make it trustworthy, and the metrics and reporting built on top. The numbers you produce will go to the CISO, the AI Governance Council, external auditors, and the board. Some of them will be challenged. Your job is to make sure they hold up.

You will work alongside an AI Security Analyst and an AI Security Automation Engineer, reporting to the Director. You will also work with Enterprise Data and Analytics on platform, semantic definitions, and BI standards, and with Product Security, SecOps, Identity, Secure IT, and Procurement, whose systems supply most of your data.

Scope boundary, stated up front. The Automation Engineer owns integration to external source systems and delivers raw data into a defined landing zone. You own everything downstream of that boundary: the data model, transformation, quality, lineage, metrics, and reporting. You specify what you need and in what shape; you are not maintaining seven partner API integrations yourself.

What You'll Own

• Governance Data Model and Pipelines Own the analytical data model for AI governance: AI systems and agents, owners, risk classifications, assessments, findings, exceptions, control results, incidents, vendors, and usage. Build and maintain the transformation layer that turns raw landed data into that model, with tests, version control, and CI. The model has to answer questions nobody has asked yet, because the regulatory and board questions will keep changing. Design for that.

• Data Quality and Lineage Own the trustworthiness of governance data. Build automated data quality checks, freshness and completeness monitoring, and end-to-end lineage that traces any reported figure back to its source system, extraction time, and transformation path. Lineage is not a nice-to-have here. An auditor will ask, and evidence by default is one of the function's operating principles. A number we cannot trace is a number we cannot report.

• Registry Data Integrity and AIBOM Reconciliation The AI System and Agent Registry is the authoritative enterprise source for what AI we run, who owns it, and how it is classified. Product Security's product asset and AI bill-of-materials records are authoritative for product control state and release status. These are two systems of record with a deliberate boundary between them. You own the scheduled reconciliation between them: matching entities across sources, resolving conflicts, attributing ownership, detecting stale and orphaned records, and producing exception reports that drive follow-up. This is genuinely hard work and it is central to the function's credibility.

• Metrics, KPIs, and KRIs Design and own the metric set that measures the program: registry coverage, discovery and shadow AI trends, risk tier distribution, assessment throughput and cycle time, control effectiveness and drift, exception aging, remediation velocity, and service performance. Design metrics that survive scrutiny. A coverage metric with an unstable denominator is worse than no metric, and being able to explain why is a core part of this job.

• Control Monitoring Analytics The Automation Engineer's control checks emit pass or fail results with attached evidence. You own the analytics on top: coverage of the control set, failure rates and trends, drift detection, time-to-remediation, and the reporting that tells the Director and the governance council whether controls are actually holding.

• Executive, Council, and Board Reporting Build and maintain the reporting that goes to the Director, the AI Governance Council, the CISO, and the board. This means visual and narrative clarity, not just correct data. You will be asked to explain what a metric means, why it moved, and what decision it should inform.

• AI Cyber Risk Quantification Data Structure risk, incident, control, and exposure data so AI risk can be expressed in financial terms for board reporting and investment prioritization. You are not expected to arrive owning a CRQ methodology; you are expected to build the data foundation that makes one possible, and to be rigorous about the uncertainty in it.

• Audit and Compliance Evidence Analytics Own the data underpinning ISO 42001 certification, EU AI Act readiness, and internal AI impact assessments. Every figure has to be accurate, defensible, traceable, and reproducible on demand.

• Cross-functional Partnership Work with Enterprise Data and Analytics on platform placement, semantic definitions, access control, and BI standards. Work with the Analyst and Automation Engineer to define what data the function needs and validate that reporting reflects ground truth. Work with partner functions to agree on definitions before metrics get published, because a disputed definition surfaces at the worst possible moment otherwise.

Who You Are

Foundational Requirements

• 4+ years in analytics engineering, data engineering, or BI engineering, with at least some of it supporting security, risk, compliance, or audit functions
• Strong SQL, including window functions, complex joins, and reasoning about query performance at scale
• Working Python (pandas or equivalent) for transformation, reconciliation, and analysis
• Data modeling and pipeline design: ETL/ELT, dimensional or equivalent modeling, incremental processing, warehousing concepts
• Hands-on BI and visualization work (Tableau, Power BI, Looker, or similar), with judgment about what belongs in a chart and what belongs in a sentence
• Cloud data platform experience (Snowflake, BigQuery, Redshift, Databricks, or similar)
• Version control and CI/CD for analytics code (Git, dbt, GitHub Actions, or equivalent)
• Comfort with imperfect, incomplete, multi-source data, and the judgment to know when to reconcile, when to flag, and when to refuse to report
• Strong written and visual communication. You will be asked to explain a metric to people who will act on it

Required Depth

You must be able to demonstrate genuine, applied experience in both of the following. This is the substance of the role, and coursework or familiarity will not suffice.

• Metrics that were consumed by a demanding audience and held up. You have built reporting for an external auditor, a regulator, an executive committee, or a board, and you have been asked to defend a number: where it came from, what it excludes, why it changed. Be prepared to describe a specific instance, including one where you were wrong or the data was, and what you did about it.
• Entity reconciliation across conflicting systems of record. You have matched the same entity across multiple sources with incomplete, contradictory, or decaying data, and dealt with the hard parts: identity resolution, ownership attribution, stale records, and deciding what to do when two authoritative systems disagree.

Strongly Preferred

• Experience building metrics or dashboards for security operations, GRC, vendor risk, or audit programs
• API-based data ingestion from security and identity tooling (SIEM, CASB, IAM, EDR, cloud audit logs)
• Data quality and observability tooling, and lineage or catalog implementation
• Exposure to AI governance frameworks (ISO 42001, NIST AI RMF, EU AI Act risk tiers) or security frameworks (NIST CSF, SOC 2), ideally through supplying audit evidence rather than reading about them
• Familiarity with cyber risk quantification methodologies such as FAIR, or experience supporting board-level risk reporting
• Exposure to AI asset inventory and AIBOM concepts, agent registries, or non-human identity data
• Experience supporting IPO readiness, SOX, or investor due diligence from a data and reporting perspective

One Non-Negotiable

This role aggregates security findings, incidents, control failures, and risk exposure across the entire enterprise. You will frequently see bad news before the people accountable for it do. Discretion, careful handling of sensitive data, and an understanding that data access is a reporting obligation rather than a decision right are requirements of the job, not preferences.