Compliance Program Manager — Regulatory Compliance

OpenAI•San Francisco, CA

2d•$216,000 - $240,000

About The Position

The Regulatory Compliance Program Manager will build and operate programs that translate regulatory requirements into clear responsibilities, effective processes, and evidence that can withstand external scrutiny. The work focuses on AI safety/security and content moderation, with privacy operations as an adjacent area. The role partners with Legal and product-building and product-operating teams to scope work, maintain accurate control narratives, prepare regulatory responses, and lead external assessments for an assigned portfolio. The initial portfolio and expectations will be agreed with the hiring manager. The successful candidate will own delivery, explain tradeoffs, and adjust recommendations as evidence changes. Success means controls have accountable owners, evidence remains current, and teams can respond accurately without repeatedly recreating the same work. The role also involves learning the GRC security-control environment and participating in the team’s on-call rotation, with scope and expectations explained during the hiring process.

Requirements

Practical experience building and operating AI safety/security and content-moderation programs, with the ability to explain personal decisions, contributions, and results.
Experience using agentic tooling to automate and improve processes at scale.
Understanding of technical concepts across model evaluation, training and release, safety controls, content moderation, and post-launch operations, including recognizing when specialist input is needed.
Strong understanding of relevant AI safety, content, and privacy requirements, including the EU AI Act, DSA, OSA, and SB 53, and experience translating them into operating processes and controls with domain experts and Legal.
Experience leading regulatory responses and external compliance audits, and distinguishing supported claims from evidence gaps.
Experience delivering complex cross-functional programs, defining practical first increments, and adapting priorities when constraints change.
Experience improving or automating an operational workflow and verifying its accuracy, usefulness, and ongoing ownership.
Ability to maintain precise records, navigate technical and compliance documentation and contract language, follow through on commitments, and judge what to resolve directly or escalate.
Clear written and verbal communication with technical teams, Legal, leadership, and external stakeholders, including explaining evidence, uncertainty, recommendations, and tradeoffs.
Ability to work constructively through disagreement, learn from feedback, and take responsibility for outcomes.

Nice To Haves

Privacy program-management experience.

Responsibilities

Lead an agreed portfolio of AI safety/security and content-compliance work, including programs associated with the EU AI Act, DSA, OSA, and SB 53, with Legal and relevant experts confirming applicable requirements.
Translate requirements into scoped programs, operating processes, control and evidence responsibilities, milestones, and clear escalation paths.
Build and maintain accurate control narratives and traceable evidence for regulatory requests, reporting, audits, and assessments.
Lead preparation and delivery for external compliance assessments, coordinate responsible teams, and track gaps through verified resolution or an explicitly owned decision.
Prioritize work that materially improves compliance outcomes and reduces risk; explain what should proceed, change, or wait and why.
Develop evidence-backed recommendations with Legal, Product, Security, Safety, Integrity, Privacy, and other functional teams, and obtain decisions from authorized owners for legal interpretation, external representations, and risk acceptance.
Improve operational workflows for content and privacy compliance while leaving implementation and operation of controls with the appropriate functional owners.
Simplify and automate repeated administrative work, test results, and verify that improvements are adopted and produce accurate, reliable outputs.
Learn the GRC security-control environment and participate in the team’s on-call rotation.
Communicate clearly, surface uncertainty early, incorporate feedback, and develop domain knowledge needed for the next priority.