Business Analyst, AI Governance & Security (AI TRISM)

The body of the mandate uses client standard business analyst description, for medium-complexity files with links across business domains. The required knowledge is what defines the role: the AI TRISM framework is marked essential, with emphasis on agent platform governance and Agent 365, explicitly mandatory. The mandate likely sits within an agentic AI governance and security initiative, where the analyst translates control, risk and security requirements into traceable business needs. The candidate must cover both sides: proven business analysis practice (5 to 8 years) and hands-on experience with the AI TRISM framework. This combination sharply narrows the talent pool.

Target candidate: a business analyst with 5 to 8 years of experience who has documented and validated AI governance, risk or security requirements, ideally on agent platforms. They have used Agent 365 in a real context and can carry a project from needs definition to deployment, in an agile setting.

Key Requirements:

• Knowledge and experience of the AI TRISM framework: AI governance, AI security model, securing and governing agent and agentic platforms
  
• Agent 365
  
• End-to-end business analysis practice (needs and requirements, traceability, impact analysis, prerequisites and dependencies, solution effectiveness validation)
  

PREFERRED

• Understanding of Agile values and principles
  
• Client behavioural competencies (client focus, cooperation, managing ambiguity, simplifying complex topics, synthesis, analytical and systems thinking)
  

ASSET

• ModelOp
  
• CBAP or PMI-PBA certification
  
• Knowledge of the banking and financial industry
  

Profiles to Exclude:

• Profile mentioning AI or generative AI without demonstrated responsibility in AI governance, risk management or security.
  
• AI security, risk or compliance specialist profile without 5 years in a business analyst role.
  
• Profile mentioning Microsoft 365 Copilot or Copilot Studio without named Agent 365 experience.
  
• Business analyst profile limited to writing requirements, with no demonstrated involvement through deployment.
  
• Data scientist or ML engineer profile focused on model development, without responsibility for business needs analysis