Artificial Intelligence Governance and Risk Manager

Since 1953, Ferguson has been a source of quality supplies for a variety of industries. Together we build better infrastructure, homes, and businesses. We exist to make our customers’ complex projects simple, successful, and sustainable, proactively solving problems and adapting to serve our customers, communities, and each other.

Location: Remote within the United States or Hybrid for associates in Newport News, VA, in accordance with company policy.

Key Responsibilities

• Own the AI Impact Assessment (AIIA) process for new and materially changed AI use cases, from intake through disposition, including maintenance of the AIIA repository as the governance record of use cases reviewed.
• Own the routing logic that determines which reviews a use case or vendor/tool requires—based on data classification, AI Solution Tier, vendor/tool status, and whether the system is agentic—captured through intake questions asked at first contact.
• Ensure AI‑specific assessment (classification, tiering, privacy screen, vendor questionnaire, agentic review as applicable) is complete before a use case or vendor request proceeds to Sourcing, InfoSec, and Legal.
• Conduct a high‑level data privacy impact screen for each use case to identify potential privacy concerns that may require escalation to a full data privacy assessment.
• Assess fairness/bias and explainability considerations as part of the AIIA, calibrated to the use case’s risk tier.
• Define and apply clear escalation criteria for full PIA, Legal review, or AI Council‑level escalation.
• Identify when an approved use case has materially changed (scope, data, vendor terms) and needs re‑review.
• Own the vendor and tool AI risk review process, including sending and evaluating AI risk questionnaires and coordinating vendor risk disposition through the Ironclad routing process with Sourcing and InfoSec.
• Develop and apply a review approach specific to agentic AI (autonomy level, action scope, data access, escalation path) in coordination with AI Technology & Innovation.
• Shadow AI: build visibility into unapproved AI usage across the organization, evaluate and administer AI governance/discovery tooling, and partner with teams to migrate to approved alternatives.
• Maintain the AI registry/governance repository as the record of approved use cases, tier, classification, and status; track and report governance health metrics to the Senior Manager.
• Maintain awareness of the AI regulatory landscape and support a regulatory register to keep policy and standards current.
• Draft and refine AI governance policy, standards, and guidelines in partnership with the Senior Manager, and route proposed changes for review by Legal, InfoSec, the AI Council, or other stakeholders.

Required Qualifications

• Experience in AI/technology governance, risk management, or compliance operations, ideally in a matrixed enterprise environment.
• Working knowledge of legal and regulatory considerations related to AI, data privacy, vendor risk, and responsible technology governance.
• Data privacy experience, including data classification and privacy impact assessment methodology.
• Working knowledge of GRC processes and third‑party/vendor risk review.
• Experience with AI discovery, monitoring, or governance tooling, including hands‑on administration.
• Ability to operate independently against a maturing governance framework and help build undefined parts of it.
• Autonomous decision‑making to assess when and what level of governance assessment is needed for AI use cases or vendor requests.
• Strong cross‑functional coordination skills, working constantly with Legal, InfoSec, Sourcing, and business stakeholders who do not report to this role.

Preferred Qualifications

• Privacy certification (e.g., CIPP/E, CIPM) alongside AI governance training or audit credential.
• Familiarity with AI‑specific risk considerations (model risk, agentic system risk, bias, explainability) distinct from general IT governance.
• Experience standing up or operating governance committee structures at the functional or business‑unit level.

Benefits

Ferguson offers a holistic benefits package that includes health, dental, vision, paid time off, life insurance, and a 401(k) with company match. Additional enhancements include mental‑health coverage, gender‑affirming and family‑building benefits, paid parental leave, associate discounts, community involvement opportunities, and more.

Pay

Estimated monthly salary range: $9,700.00 – $15,516.67 (actual pay may vary by location and experience). This role is eligible for bonus or incentive plans.