AI Governance, Security & Compliance Manager

Hagadone Media Group•Coeur d'Alene, ID

112d•Onsite

About The Position

The AI Governance, Security & Compliance Manager leads Hagadone Corporation’s enterprise AI governance, cybersecurity governance, risk management, and compliance programs. The role enables responsible AI adoption by establishing governance frameworks, policies, risk controls, and practices that support innovation while protecting business operations, data, and regulatory compliance. It partners with executive leadership and teams across IT, Human Resources, Finance, Legal, and third-party vendors to maintain security and compliance programs, including PCI DSS compliance, risk assessments, policy management, audit coordination, and regulatory readiness. The manager advises on emerging AI technologies and information security risks, translating technical and regulatory requirements into practical, sustainable, auditable business processes. This is a governance and leadership role rather than a hands-on systems administration or security operations position. It reports directly to the Chief Information Officer (CIO) and is based on-site at Hagadone Corporation’s headquarters in Coeur d’Alene, Idaho. Regular in-person attendance is required. The position leads AI strategy and governance, including evaluating and prioritizing AI initiatives, maintaining an AI governance framework and tool registry, conducting AI risk assessments, developing employee training and communications, and advising business units and vendors on responsible AI integration. It also leads security governance, risk, and compliance activities; coordinates PCI DSS readiness and audit requests; manages policies, control documentation, exceptions, and remediation; and supports security program coordination, incident response and disaster recovery readiness, reporting, and employee security awareness.

Requirements

Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business Technology, Risk Management, or a related field; equivalent practical experience will be considered.
At least 4 years of experience in information security compliance, GRC, cybersecurity governance, IT audit, or security program management.
Demonstrated experience or strong working familiarity with AI technologies, generative AI tools, and AI governance concepts, including risk, data privacy, acceptable use, and responsible adoption.
Experience supporting or leading PCI DSS assessments, audit readiness, or control validation efforts.
Experience developing and maintaining security policies, procedures, standards, and documentation.
Strong verbal and written communication skills, including the ability to clearly present complex topics to executive and non-technical audiences.
Strong organizational skills and ability to manage multiple workstreams and priorities simultaneously.
Working knowledge of common IT and security control domains, including identity and access management, vulnerability management, incident response, endpoint and network security, and third-party/vendor risk.

Nice To Haves

Hands-on experience evaluating, piloting, or governing AI tools such as Microsoft Copilot, ChatGPT/OpenAI, or Google Gemini in a business environment.
Experience with additional security frameworks such as NIST CSF, CIS Controls, ISO 27001, SOC 2, HIPAA, or SOX IT controls.
Experience in environments subject to PCI DSS, cyber insurance controls, financial audit requirements, or other formal compliance obligations.
Experience helping establish or mature a compliance, governance, or AI governance function in a growing organization.
Experience working with external assessors, auditors, insurers, AI vendors, or technology consultants.
One or more preferred certifications: CISA, CRISC, CISM, CISSP, PCI ISA, PCIP, or ISO 27001 Lead Implementer or Lead Auditor.

Responsibilities

Champion and lead the organization’s AI adoption strategy, identifying and prioritizing AI tools and initiatives with senior leadership.
Develop and own the AI governance framework, including policies, standards, risk assessment processes, and decision-making workflows for AI tool approval and oversight.
Conduct AI risk assessments addressing data privacy, confidentiality, security, accuracy, vendor risk, regulatory exposure, and ethical considerations.
Establish and maintain an AI tool registry and approval process, ensuring AI systems are vetted, documented, and monitored.
Develop AI literacy and readiness programs, including training, change management, and employee communications.
Define and communicate AI guardrails, acceptable-use standards, and data-classification guidance.
Monitor the evolving AI regulatory and risk landscape and surface relevant considerations to leadership.
Advise business units on responsible AI integration and governed adoption; partner with vendors, technology partners, and external advisors to evaluate platforms, contractual safeguards, and shared responsibilities.
Lead development, implementation, and maintenance of the information security governance, risk, and compliance program.
Coordinate the PCI DSS process, including evidence collection, control validation, remediation tracking, and year-round readiness.
Coordinate cyber insurance security requirements, questionnaires, renewals, and control attestations.
Assist with financial, cybersecurity, regulatory, and third-party audit requests; gather documentation, coordinate responses, and track follow-up items to completion.
Maintain repositories of policies, standards, procedures, control documentation, evidence, exceptions, and remediation plans.
Identify control gaps and coordinate development, documentation, and tracking of corrective actions.
Manage policy exceptions, risk acceptances, and compensating-control documentation in alignment with business and security needs.
Monitor regulatory, contractual, insurance, and industry requirements and help maintain organizational alignment.
Develop, maintain, and periodically review information security and AI governance policies, standards, procedures, and guidelines.
Align policies with operational practices, business objectives, and applicable frameworks, including PCI DSS, NIST CSF, and NIST AI RMF.
Collaborate with HR, Legal, Finance, IT, and operational teams to integrate policy requirements into company processes and employee expectations.
Support policy communications, employee acknowledgments, and policy updates as systems, risks, AI tools, and business practices evolve.
Partner with IT and stakeholders to oversee documentation and governance of access control, vulnerability management, logging and monitoring, incident response, backup and disaster recovery, change management, endpoint protection, and third-party/vendor risk.
Review remediation progress for vulnerabilities, audit findings, and control gaps, helping prioritize actions according to risk and business impact.
Support incident response and disaster recovery readiness through documentation reviews, lessons-learned tracking, tabletop exercises, and recovery-planning coordination.
Prepare reports, dashboards, and leadership briefings on compliance status, key risks, remediation progress, AI governance status, and program maturity.
Coordinate and improve the security awareness and education program, including AI-specific training content.
Develop employee guidance on phishing, acceptable use, data handling, password hygiene, third-party risks, AI usage, and other security topics.
Promote security awareness and responsible technology use, including thoughtful AI adoption, across the organization.