Head of Enterprise Risk Management

Head of Enterprise Risk Management

OpenAI is an artificial intelligence research and deployment organization focused on developing safe, beneficial AI systems at scale. The company builds and operates foundational AI models and products that reach millions of users worldwide, operating in a rapidly evolving regulatory and technical landscape. As the frontier of AI development shapes new risk management challenges, OpenAI is strengthening its governance and risk infrastructure to support responsible innovation and sustainable growth.

The Finance team at OpenAI is establishing a modern enterprise risk management capability to help leadership identify, assess, and act on the risks that matter most across the organization. This team partners with Security, Compliance, Legal, Engineering, Product, People, Operations, and Internal Audit to connect risk strategy with governance, assurance, and decision-making. You will help translate this vision into practical systems, workflows, and a strong risk culture embedded throughout the company.

What you'll do

• Design and establish OpenAI's enterprise risk management framework, risk taxonomy, governance standards, risk appetite thresholds, and mitigation expectations.

• Lead comprehensive risk assessments and maintain a centralized risk register that tracks strategic, financial, operational, technology, security, compliance, and emerging risks.

• Build key risk indicators, continuous monitoring systems, and executive dashboards that surface clear signals, trends, and recommended actions from complex data.

• Guide risk-informed decision-making for new products, markets, partnerships, acquisitions, major systems, and strategic investments across the organization.

• Define and execute the roadmap for a modern ERM platform that integrates with enterprise systems including identity management, finance, HR, ticketing, engineering infrastructure, and others.

• Apply automation, policy-as-code, data analytics, and AI-assisted tools to streamline evidence collection, control monitoring, issue management, and regulatory responses.

• Coordinate risk activities and ownership across all business functions, clarifying accountability and reducing duplication across the three lines of defense.

• Recruit, develop, and lead a high-performing team while fostering a culture of practical risk management and continuous improvement.

What you'll bring

• Twelve or more years of experience in enterprise risk, operational risk, compliance, internal audit, security governance, finance, or related disciplines, with substantial experience building or scaling ERM or GRC programs.

• Proven success establishing enterprise risk programs in fast-growing, technology-driven, or complex global organizations.

• Deep knowledge of ERM and assurance practices including risk appetite, assessments, key risk indicators, controls frameworks, issue management, and the three-lines model; familiarity with COSO, ISO/IEC standards, or similar frameworks.

• Ability to translate complex risk information for executives and boards with sound judgment and clear communication.

• Technical fluency with GRC platforms, data architecture, APIs, system integrations, cloud environments, and automated workflows.

• Experience using data analytics, automation, or AI tools to enhance risk sensing, evidence analysis, and control monitoring.

• Capacity to work across technical and non-technical teams, connecting strategic, financial, operational, technology, security, and compliance risks.

• Track record hiring and developing diverse, multidisciplinary teams while operating effectively in ambiguity and at pace.

Nice to have

• Infrastructure-as-code, CI/CD, or policy-as-code experience.

• Credentials such as CIA, CPA, CISA, CRMA, or CRM; advanced degree in business, law, or technical field.

What they offer

• Hybrid work arrangement requiring three days per week in the San Francisco office.

• Relocation assistance provided for new employees.