As Carter's accelerates its use of AI technologies — including generative AI assistants, AI-enabled SaaS applications, MCP (Model Context Protocol) connectors, and agentic workflows — this role will ensure that AI adoption is governed with the same rigor applied to any other enterprise technology risk. The Manager will balance traditional IT GRC fundamentals with forward-looking AI governance leadership, making this a uniquely strategic position within the IT organization.

AI Governance & Emerging Technology Risk (YR 1 – approx. 60%)

• Lead the development and implementation of Carter's AI Governance Framework, defining policies for acceptable use, data classification, model risk, vendor AI tools, and agentic workflows aligning with the company’s ERM program.

• Maintain a comprehensive inventory of AI tools and connectors deployed across the enterprise, including MCP servers, generative AI platforms, and AI-enabled SaaS integrations (e.g., Atlassian, Microsoft 365, Snowflake, Adobe Analytics).

• Conduct and oversee AI risk assessments covering data exposure (including PII), identify potential vulnerabilities, unauthenticated access risks, and potential risk exposure in MCP connector packages.

• Define and enforce controls for AI connector permissions, least-privilege access, credential management, and data loss prevention in AI workflows.

• Monitor the AI regulatory landscape (e.g., EU AI Act, NIST AI RMF, ISO/IEC 42001, state AI laws) and translate requirements into actionable controls and policy updates for Carter's.

• Ensure AI governance aligns with data privacy obligations (e.g., CCPA, COPPA, GDPR) applicable to Carter's customer base, which includes children's products.

• Provide support to the Carters AI COE team and assist with AI Governance across multiple departments.

Compliance & Regulatory Management (40%)

• Oversee compliance with applicable regulatory frameworks and standards including SOX ITGC, PCI DSS, NIST (Cybersecurity and AI), and CCPA etc.

• Manage the IT control testing calendar, coordinate evidence collection, and liaise with internal and external auditors throughout audit engagements.

• Track remediation of audit findings and control deficiencies, providing regular status reporting to the Director of IT GRC and leadership.

• Support enterprise IT privacy program activities in coordination with the Legal and IT teams, particularly where technology systems process personal data.

Must have:

• At Least a bachelor’s degree in a technical field of studies (Mathematics, Computer Science, Accounting, etc.)
• 7+ years of progressive experience in IT Governance Risk Compliance (GRC), information security, risk management, or a related discipline
• 7+ years of experience related to building and implementing IT Governance Risk Management programs 
• 2+ years of direct involvement in AI governance, AI risk assessment, or significant responsibility for AI tool security and compliance.
• Professional certification (CISSP, CISA, CISM, CGEIT, CRISC, AAIA, AAIR or similar)
• Strong foundational knowledge of IT GRC frameworks: NIST CSF, NIST AI, ISO 27001, COBIT, SOX ITGC, PCI DSS, and SOC 2.
• Working knowledge of AI technologies, including generative AI tools, large language models, MCP (Model Context Protocol) server architectures, and agentic AI workflows.
• Experience assessing AI and SaaS vendor risk, including security questionnaire review, CVE management, and third-party audit evaluation.
• Understanding data privacy regulations applicable to Carter's: CCPA, CPRA, and GDPR.
• Proven ability to manage cross-functional programs and influence stakeholders across IT, Legal, Finance, and business without direct authority.
• Strong written and verbal communication skills; able to translate complex technical risk topics for executive and non-technical audiences.