Controls Analyst - AI Risk & Governance

About the role

Moody's is hiring an experienced Controls Analyst in Gurugram, India, within its Internal Controls team. The team strengthens the control environment by evaluating and improving controls that mitigate financial, cybersecurity, operational and emerging technology risks, and the role includes work on AI governance and risk initiatives.

Key responsibilities

• Carry out end-to-end control assessments: planning, walkthroughs, evidence reviews, testing, issue validation and reporting.
• Run AI risk assessments for AI tools, applications, agents, connectors, plugins and model-driven solutions, covering governance, security, data exposure, autonomy and oversight.
• Analyse vendor assurance documentation such as SOC reports, ISO certifications, trust-center materials and security documentation.
• Develop and review Risk and Control Self-Assessments (RCSAs) with risk statements, control mappings, effectiveness evaluations and residual risk.
• Support ISO/IEC 27001:2022 readiness reviews, internal audits and continuous control monitoring.
• Prepare clear assessment reports with findings, risks, observations and recommendations.
• Work with control owners, product and technology teams to drive remediation and maintain workpapers, issue logs and governance reporting.
• Use data analytics, automation and approved AI tools to improve assessment efficiency and reporting quality.

Required profile

• 2-4 years of experience in AI risk management, AI governance, technology risk, model risk, IT audit, information security, GRC or a related discipline, preferably in financial services, a Big Four firm or a global organisation.
• Bachelor's degree in Computer Science, Information Systems, Engineering or a related discipline.
• Preferred certifications: ISO/IEC 42001 or 27001 Lead Auditor/Implementer, CISA, AAIA, AISM, AAIR, CISSP or CRISC.

Required skills

• Knowledge of AI risk concepts (prompt injection, hallucinations, data exposure, bias, explainability, model drift, shadow AI, third-party dependencies).
• Familiarity with frameworks such as NIST AI RMF, ISO/IEC 42001, EU AI Act and OWASP Top 10 for LLM Applications.
• Understanding of cloud environments, APIs, integrations, access controls and data flows.
• Proficiency in Microsoft Office; exposure to Power BI, Power Automate, ServiceNow, OpenPages, OneTrust or Microsoft Copilot is an advantage.