Governance, Risk & Compliance Manager (IT)

• Lead the development and implementation of Carter's AI Governance Framework, defining policies for acceptable use, data classification, model risk, vendor AI tools, and agentic workflows aligning with the company’s ERM program.

• Maintain a comprehensive inventory of AI tools and connectors deployed across the enterprise, including MCP servers, generative AI platforms, and AI-enabled SaaS integrations (e.g., Atlassian, Microsoft 365, Snowflake, Adobe Analytics).

• Conduct and oversee AI risk assessments covering data exposure (including PII), identify potential vulnerabilities, unauthenticated access risks, and potential risk exposure in MCP connector packages.

• Define and enforce controls for AI connector permissions, least-privilege access, credential management, and data loss prevention in AI workflows.

• Monitor the AI regulatory landscape (e.g., EU AI Act, NIST AI RMF, ISO/IEC 42001, state AI laws) and translate requirements into actionable controls and policy updates for Carter's.

• Ensure AI governance aligns with data privacy obligations (e.g., CCPA, COPPA, GDPR) applicable to Carter's customer base, which includes children's products.

• Provide support to the Carters AI COE team and assist with AI Governance across multiple departments.

• Oversee compliance with applicable regulatory frameworks and standards including SOX ITGC, PCI DSS, NIST (Cybersecurity and AI), and CCPA etc.

• Manage the IT control testing calendar, coordinate evidence collection, and liaise with internal and external auditors throughout audit engagements.

• Track remediation of audit findings and control deficiencies, providing regular status reporting to the Director of IT GRC and leadership.

• Support enterprise IT privacy program activities in coordination with the Legal and IT teams, particularly where technology systems process personal data.

• At Least a bachelor’s degree in a technical field of studies (Mathematics, Computer Science, Accounting, etc.)
• 7+ years of progressive experience in IT Governance Risk Compliance (GRC), information security, risk management, or a related discipline
• 7+ years of experience related to building and implementing IT Governance Risk Management programs 
• 2+ years of direct involvement in AI governance, AI risk assessment, or significant responsibility for AI tool security and compliance.
• Professional certification (CISSP, CISA, CISM, CGEIT, CRISC, AAIA, AAIR or similar)
• Strong foundational knowledge of IT GRC frameworks: NIST CSF, NIST AI, ISO 27001, COBIT, SOX ITGC, PCI DSS, and SOC 2.
• Working knowledge of AI technologies, including generative AI tools, large language models, MCP (Model Context Protocol) server architectures, and agentic AI workflows.
• Experience assessing AI and SaaS vendor risk, including security questionnaire review, CVE management, and third-party audit evaluation.
• Understanding data privacy regulations applicable to Carter's: CCPA, CPRA, and GDPR.
• Proven ability to manage cross-functional programs and influence stakeholders across IT, Legal, Finance, and business without direct authority.
• Strong written and verbal communication skills; able to translate complex technical risk topics for executive and non-technical audiences.

Carters is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity, sexual orientation, national origin, genetics, disability, age, veteran status, or any other status protected by federal, state, or local law.