How to find an AI governance specialist.

AI governance is the clearest example of a role where searching the job title actively misleads you. The title appeared when regulation created demand, which means adverts arrived faster than careers could form. Anyone claiming ten years in AI governance is describing work they called something else at the time.

That is the opportunity. The people who can do this job have been doing it for years under other names — data protection officers translating GDPR into technical controls, model risk managers validating models under SR 11-7 since 2011, IT auditors testing algorithmic systems. They are more experienced than the title-holders and dramatically less contested.

Job titles worth searching

Grouped by what the person actually does, because searching all46 at once produces a result set you cannot triage. Decide which group you need first — that decision does more for the search than any string below.

Frameworks and credentials that signal capability

AI-specific certifications are new and thinly held, so the useful signals are mostly borrowed from adjacent disciplines — privacy credentials, framework implementation experience, and in US banking, model validation under SR 11-7.

Where AI governance people actually are

IAPP is the centre of gravity. Its conferences, certification directories, and publications identify practitioners with real standing in privacy and increasingly in AI governance, and the community is unusually willing to be found — the field is new enough that people are actively building reputation.

For technical governance roles, the research literature is the better source. FAccT and the responsible AI workshops attached to major machine learning conferences publish work on fairness, interpretability, and evaluation, with author affiliations attached. Someone with papers in this area understands model behaviour in a way a policy background does not supply.

Two underused sources deserve mention. Financial services model risk functions have run genuine model governance for over a decade under SR 11-7, and those candidates almost never appear in AI governance searches. And people leaving data protection authorities and regulators understand enforcement from the inside — a small population, rarely approached, and disproportionately valuable when regulation is new and untested.

Boolean search strings

Written to be pasted as-is. Each one is built around an intent rather than a platform, since the useful question is what you are trying to find, not which site you happen to be on.

site:linkedin.com/in/ ("AI governance" OR "responsible AI" OR "AI ethics") ("EU AI Act" OR "NIST AI" OR CIPP) "{city}"

("data protection officer" OR "privacy counsel" OR CIPP OR CIPM) ("AI" OR "automated decision" OR "algorithmic") -jobs -course

("model risk" OR "model validation" OR "SR 11-7" OR "model governance") ("machine learning" OR "AI") -jobs -hiring

("EU AI Act" OR "AI Act" OR "high-risk AI system" OR "conformity assessment") ("implementation" OR "readiness" OR "compliance") -jobs -webinar

(site:arxiv.org OR site:scholar.google.com) ("algorithmic fairness" OR "model interpretability" OR "AI evaluation" OR "model cards")

("speaker" OR "panelist") ("AI governance" OR "responsible AI" OR "AI policy") (IAPP OR FAccT OR "AI Safety") 2024..2026 -jobs

("ISO 42001" OR "ISO/IEC 42001" OR "NIST AI RMF" OR "AI management system") ("lead implementer" OR "lead auditor" OR "certified") -jobs -training

("data protection authority" OR "ICO" OR "CNIL" OR "regulator") ("AI" OR "algorithmic") ("former" OR "previously" OR "ex-") -jobs

Mistakes that cost the most time

1. Searching only for the title

   AI governance barely existed as a job title five years ago, so almost nobody holds it with meaningful tenure. Searching the title alone returns a small pool dominated by recent adopters. The qualified people are working under privacy, model risk, audit, and policy titles, and they are considerably more experienced than the title-holders.

2. Overlooking the privacy profession

   GDPR created a whole profession of people who translate regulation into technical controls, run impact assessments, and hold their ground with engineering teams. That is the AI governance job with a different regulation attached. Data protection officers and privacy engineers are the highest-yield adjacent pool, and most recruiters filling these roles never look at them.

3. Ignoring financial services model risk

   Banks have validated models under SR 11-7 since 2011, with documented methodology, independent challenge, and ongoing monitoring. That is a decade-plus head start on everyone else. These candidates rarely describe themselves in AI governance terms, which is exactly why they remain available.

4. Conflating ethics interest with governance capability

   A great many candidates express genuine interest in AI ethics. Far fewer have implemented a control framework, run an audit, or argued a risk categorisation with a regulator. The role is usually operational rather than philosophical, and screening on stated interest rather than delivered work produces shortlists that cannot do the job.

5. Not deciding whether the role is technical or policy

   These are different hires. A role requiring critical reading of model cards, evaluation design, or bias testing needs a technical background. A role focused on regulatory interpretation, policy authorship, and regulator engagement needs a legal or policy one. Very few people do both well, and adverts that ask for both attract neither.

6. Underestimating how fast the regulatory picture moves

   EU AI Act obligations phase in on a staged timeline, and national implementations vary. A candidate whose knowledge dates from a year ago may be materially out of date. Ask what they have read recently and what they think is still unsettled — the answer separates current practitioners from people who took a course once.

Common questions

What job titles should I search for when hiring an AI governance specialist?

Search well beyond the emerging titles, because almost nobody holds AI Governance Specialist or AI Ethics Officer with meaningful tenure. The strongest adjacent pool is privacy: Data Protection Officer, Privacy Counsel, Privacy Engineer, and CIPP holders already translate regulation into technical controls. Financial services model risk is the second: Model Risk Manager and Model Validation Analyst have governed models under SR 11-7 since 2011. Add algorithmic audit titles such as IT Auditor and Technology Risk Auditor, and for technical roles, Responsible AI Researcher and ML Fairness Researcher.

Why is it so hard to find experienced AI governance candidates?

Because the title is younger than the work. Demand was created largely by the EU AI Act and similar regulation, which means job adverts appeared faster than careers could form. Anyone claiming a decade in AI governance is describing something they called by another name at the time — most often privacy, model risk, or algorithmic audit. The practical consequence is that title-based searching returns a small pool of recent adopters while the genuinely experienced people sit under adjacent titles and are far less contested.

Should an AI governance hire be technical or policy focused?

Decide before sourcing, because they are different hires and few people do both well. A technical governance role — designing evaluations, reading model cards critically, running bias testing, building assurance tooling — needs someone from a machine learning or engineering background. A policy-focused role — interpreting regulation, authoring internal policy, engaging with regulators, running conformity assessments — needs legal, privacy, or policy experience. Adverts asking for deep expertise in both tend to attract neither, and produce long searches that end in a compromise hire.

Which AI governance certifications are worth anything?

The IAPP's AIGP is the first widely recognised AI-specific credential, though the population holding it is small and nobody has held it long. More telling in practice are the established privacy certifications — CIPP/E, CIPM, and especially CIPT for the technical side — because they indicate regulatory literacy built over years. ISO 42001 lead implementer or auditor qualifications are becoming a genuine differentiator, as is documented experience applying the NIST AI Risk Management Framework. For US financial services, SR 11-7 model validation experience outweighs any certification.

Where can I find AI governance professionals outside LinkedIn?

IAPP is the centre of gravity for this community — its events, publications, and certification directories identify practitioners with genuine standing. For technically oriented roles, FAccT and the responsible AI workshops at major machine learning conferences publish papers and speaker lists that show who actually works on fairness, interpretability, and evaluation. Regulatory bodies are an underused source: people leaving data protection authorities understand enforcement from the inside. Finally, ISO 42001 and NIST AI RMF implementation work is concrete enough to search for directly.