General Dynamics Mission Systems is seeking a Director, IT Governance, Risk, Compliance & AI to lead the enterprise governance function across information technology, cybersecurity, privacy, data, financial systems, and artificial intelligence. Reporting to the Chief Data & AI Officer (CDAIO), who has assumed the broader enterprise technology, data, AI, and governance portfolio, this director will establish and operate an integrated, risk-based governance model that protects the company, enables disciplined innovation, and improves the speed and quality of decision-making.
The director will partner across Business Operations, Cybersecurity, Finance, Legal, Privacy, Internal Audit, Contracts, Engineering, Supply Chain, programs, and business leadership. The successful candidate will translate complex regulatory, contractual, technical, and business requirements into clear policies, practical controls, measurable accountability, and sustainable operating practices. They will bring bold ideas and deep expertise while building upon and advancing an established vision. Success in this role requires both strong individual contribution and the ability to collaborate across CDAIO teams and enterprise partners, harness collective capabilities, and strengthen the organization’s overall effectiveness.
Key Responsibilities
- Lead the enterprise IT governance, risk, and compliance strategy and operating model, ensuring alignment with business objectives, mission needs, regulatory obligations, and the enterprise technology, data, and AI strategy.
- Direct and develop a multidisciplinary governance organization; establish priorities, performance expectations, succession capability, and a culture of accountability, continuous improvement, and customer focus.
- Own the development, maintenance, communication, and enforcement of IT governance policies, standards, procedures, control frameworks, exception processes, and accountability mechanisms.
- Lead governance and assurance for IT general controls, application controls, access management, change management, configuration management, vulnerability management, secure development, third-party services, and other technology risks.
- Oversee SOX-related IT controls and partner with Finance, Internal Audit, external auditors, and system owners on control design, testing, evidence, deficiencies, remediation, and closure.
- Partner with the CISO and cybersecurity organization to govern security risk, policy, exceptions, risk acceptance, compliance assessments, remediation, and executive reporting without duplicating operational security ownership.
- Drive compliance readiness for applicable frameworks and contractual requirements, including NIST, CMMC, DFARS, privacy, controlled unclassified information, export-controlled information, and customer obligations.
- Establish AI governance within the enterprise GRC model, including risk tiering, acceptable use, use-case intake, data and privacy safeguards, third-party AI risk, human oversight, documentation, monitoring, and lifecycle controls.
- Partner with AI strategy, delivery, data, engineering, and cybersecurity leaders to make the responsible path for AI adoption clear, efficient, and proportionate to risk; identify opportunities to use AI to improve governance operations and control monitoring.
- Lead internal and external audit coordination across IT, cybersecurity, privacy, data, and AI; ensure evidence is audit-ready, findings have accountable owners and due dates, and corrective actions are validated to closure.
- Develop executive-level governance, risk, compliance, and AI reporting, including meaningful metrics, risk trends, control health, audit posture, remediation progress, and investment priorities.
- Govern IT programs and projects at defined decision points to assess strategic alignment, risk, controls, compliance, resource use, and expected business value.
- Plan and manage the department budget; identify opportunities to simplify, standardize, automate, and continuously improve governance processes and service delivery.
- Build trusted relationships across geographically dispersed teams and influence senior stakeholders through clear communication, sound judgment, and practical risk recommendations.
Required Qualifications
- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Risk Management, Business, or a related field, or an equivalent combination of education and relevant experience, plus at least 15 years of demonstrated leadership experience; or a master's degree plus at least 13 years of demonstrated leadership experience.
- Substantial leadership experience in IT governance, risk, compliance, information security, audit, or related enterprise technology functions within a highly regulated environment.
- Demonstrated experience leading complex, geographically dispersed technical organizations and developing leaders and technical professionals.
- Strong knowledge of IT control frameworks and risk methodologies, including relevant NIST frameworks, COBIT, ITIL, ISO 27001, and/or comparable standards.
- Demonstrated experience with IT SOX controls, audit coordination, control testing, remediation management, and executive reporting.
- Working knowledge of defense-industry and government-contracting requirements relevant to technology governance, including CMMC, NIST SP 800-171/172, DFARS, CUI, and supplier or third-party risk, as applicable.
- Knowledge of AI governance principles, including responsible AI, model and data risk, privacy, security, human oversight, third-party AI services, AI lifecycle controls, and the NIST AI Risk Management Framework or comparable practices.
- Ability to assess risk pragmatically and translate legal, regulatory, contractual, and technical requirements into clear, executable business actions.
- Excellent executive communication, presentation, relationship-building, organizational-change, and influence skills.
Preferred Qualifications
- Professional certifications such as CISSP, CISM, CISA, CRISC, CIPP, PMP, CGEIT, or comparable credentials.
- Experience implementing scalable governance workflows, continuous control monitoring, automated evidence collection, or governance tooling.
- Experience governing AI-enabled business processes, generative AI, or agentic AI use cases in a regulated or mission-focused environment.
- Experience with privacy-by-design, enterprise data governance, cloud governance, and third-party technology or supply-chain risk management.
- Active security clearance or ability to obtain and maintain a clearance, as required by position access.
