The role We are seeking a senior risk professional to be an independent advisor within our Risk & Compliance function to lead in advising the firm on Technology, AI and Innovation Risk. This role will lead the assessment, governance, and ongoing management of risks and regulatory requirements arising from the firm’s use of emerging technologies, including artificial intelligence (AI), automation, and digital innovation. The successful candidate will combine strong regulatory and risk expertise with commercial pragmatism and a deep understanding of technology risk in a professional services or legal environment. Key responsibilities Strategic Technology & AI Risk Oversight Lead the firm’s approach to identifying, assessing, and mitigating risks associated with new and emerging technologies, including AI tools and platforms. Develop and maintain a Technology and AI Risk Framework, aligned to legal sector regulatory expectations and industry best practice. Advise senior stakeholders (including CIO, CTO, Innovation teams, and partners) on risk, regulatory and reputational implications of technology adoption. Collaborate closely with key stakeholders to ensure that AI Risk oversight complements and supports the firm's information security, data privacy and enterprise risk management frameworks. Ensure alignment with firm-wide risk appetite and governance standards. Business Partnering with IT & Innovation Teams Act as a dedicated Risk advisor to IT, cybersecurity, and innovation functions. Embed risk-by-design principles into technology development, procurement, and implementation processes. Participate in key technology governance forums, steering committees, and project boards as appropriate. AI Governance & Responsible Use Design and implement policies covering responsible AI use, that embed and reflect the firm's compliance policies including: Confidentiality Model risk and explainability Bias and ethical considerations Client confidentiality, professional conduct obligations and legal privilege risks AI security threats (e.g. prompt injection, data poisoning, model and data exfiltration), adversarial testing / AI red-teaming, model inventory and validation Establish approval, review, detection and containment processes for AI tools (including generative AI), covering sanctioned tools and unsanctioned “shadow AI” use in collaboration with IT Risk & Security. Establish approval and review processes for AI tools (including generative AI). Working with the General Counsel team, ensure appropriate client disclosures where required, including in relation to Outside Counsel Guidelines and client-specific security and AI-use requirements. Horizon Scanning Monitor and interpret global regulatory developments relating to: AI regulation (e.g. EU AI Act and equivalents) Legal sector obligations and professional standards NIS2 / DORA and equivalent operational resilience or cybersecurity regimes where in scope Client-jurisdiction AI, data and security regimes applicable to firm operations or client requirements Translate regulatory requirements into actionable internal policies and controls. Technology Risk Assessment & Controls Conduct and advise on risk assessments, as appropriate, for new systems, vendors, and technology deployments. Collaborate with IT on: Regulatory and client-obligation mapping for third-party and technology risk Control-adequacy challenge and policy sign-off for information security controls Regulatory notification, AI-incident handling, client disclosure and privilege considerations in incident response Ensure risks are documented, tracked, and reported through appropriate governance forums. Training & Culture Develop and deliver training on technology and AI risks for lawyers and business services teams. Promote a culture of responsible innovation and risk awareness. Reporting & Governance Provide regular reporting to the Executive Risk Committee and Board-level stakeholders on technology and AI risk exposure. Maintain risk registers and key risk indicators (KRIs) relating to technology and innovation integrated with the firm’s enterprise and information security risk registers.