Key Skills

Job Description

About The Internship We are building our AI governance framework and strengthening our compliance operations at the same time, and you'll be part of both. You'll join our Cybersecurity & Risk Governance team to map how teams use generative AI, draft the policies that govern it, and keep our audit evidence ready for our SOC 2 Type 2 and ISO audits. This is the foundation of how we manage AI risk, and every deliverable is reviewed and put to use. In This Role, You Will Interview departments about their use of generative AI, and build and maintain our Shadow AI risk registry Draft acceptable use policies and gap analyses against NIST AI RMF, ISO/IEC 42001 and the EU AI Act, and support AI impact assessments Collect and organize compliance evidence in Drata for our SOC 2 Type 2 and ISO audits Run third-party vendor risk reviews, update security questionnaires and maintain the operational risk register What You'll Learn You'll get hands-on experience with enterprise GRC workflows and compliance tooling like Drata in a specialized, international team. Every policy draft and gap analysis you write gets direct feedback before it's put to use. Who We're Looking For You will thrive here if you: Are following a bachelor's or master's program, in cybersecurity, risk management, law, ESG, compliance, technology policy or a related field Are organized and analytical, with sharp attention to detail and strong policy writing skills Speak and write fluent English Have an interest in or knowledge of frameworks such as ISO 27001, GDPR, SOC 2, ISO/IEC 42001 or NIST AI RMF Datamaran is the AI-powered governance platform for enterprise. Regulations change. Stakeholders shift. Markets move. Large organizations are expected to hold a clear, defensible position on all of it, and most still get there through slow manual work on fragmented signals. We turn regulatory, stakeholder and market signals into intelligence that leadership teams can act on, built on 12+ years of expertise in non-financial risk. Risk, legal, compliance, sustainability and corporate affairs teams at Bridgestone, Dell, Cisco, Kraft Heinz and PepsiCo use Datamaran to decide what matters, and to stand behind that decision afterwards. We are 104 people across the UK, US, Spain and the Netherlands. Know what's coming. Act on it.

Core Responsibilities

Interview departments about their generative AI use and maintain a Shadow AI risk registry. Draft AI policies and framework gap analyses, support impact assessments, organize audit evidence in Drata, and conduct vendor risk reviews.

Requirements

Applicants must be pursuing a bachelor's or master's degree in cybersecurity, risk management, law, ESG, compliance, technology policy, or a related field. They should be organized, analytical, detail-oriented, strong policy writers, fluent in English, and interested in or knowledgeable about relevant compliance and AI governance frameworks.