AI Data Governance Deputy Director
Summary
Senior governance role at Thai retailer CJ Mart (with TD Tawandang): you own the AI & data governance policy day to day — risk-based approvals, data classification, PDPA compliance, IAM/DLP/SIEM controls, incident response, vendor risk and staff training — so the retail group can adopt AI quickly and responsibly.
Join us if you:
• Make “Yes” Safe, Not “No” Easy: You believe good governance should speed AI adoption up, not slow it down — fast lanes for low-risk use, heavy controls only where the real risk is.
• Write Rules People Actually Follow: A policy nobody uses has failed. You write clear, practical rules and turn them into controls teams actually adopt.
• Fix the System, Not the Symptom: When an incident or gap shows up, you close the root cause so it doesn’t come back next month.
• Trust Evidence Over Opinion: You judge risk on what you checked — logs, data flows, real use cases — not on assumptions or fear.
• Stay Hands-On With the Tools: You use AI assistants, agents and automations yourself, so you know where the real friction and risks are.
What is this role?
As AI Data Governance Deputy Director, you will work closely with the Head of Business Excellence (BSX) to own how CJ Mart and TD Tawandang use AI and data — safely and at speed. You will run the AI & Data Governance Policy day to day, act as operational lead to the AI & Data Committee, and build the controls and people network that let every function adopt AI fast and responsibly.
What will you do?
• Own Policy Assurance, Framework & Standards:
– Own the Policy’s change-control process — review for consistency, clarity and feasibility, and propose only targeted, rationale-backed amendments where it proves unclear, contradictory or impractical.
– Define the enterprise AI risk appetite with the AI & Data Committee, translate it into practical controls and templates, and design “fast lanes” that speed up low-risk adoption.
• Own Data Governance & Classification:
– Own the data-classification scheme for AI use (public / internal-with-masking / restricted) and the rules on which data may go into which class of AI tool, incl. masking, anonymisation and synthetic-data standards.
– Enforce least-privilege and read-only-by-default access for AI and agents to data, files and systems.
• Run Risk, Compliance, Privacy & Security Controls:
– PDPA & privacy (with the DPO): privacy impact assessments, data-subject rights, retention and deletion.
– Identity, data & network security: apply IAM controls (SSO, MFA, RBAC, joiner-mover-leaver, privileged-access review) to AI/agent accounts; turn data classification into DLP/masking rules; partner with IT Security and Architecture on egress, GCP controls and SIEM monitoring.
– Risk-based approvals: operate the Low / Medium / High approval model as coordinating gatekeeper for AI use cases.
• Manage Approved AI Tools & Use Cases:
– Own the Approved AI Tool Register and the use-case intake/approval workflow with clear SLAs; risk-assess new tools, plugins, connectors and MCP servers before approval.
– Maintain the Use-Case Register — owner, purpose, data scope, controls, review date and kill-switch plan.
• Govern the AI/Automation Lifecycle, Agentic AI & Citizen Developers:
– Own the AI/automation lifecycle (idea → sandbox → production → decommission) with a Lightweight Path for low-risk and a Managed Path for medium/high-risk use, plus a citizen-developer competency ladder (AI user → automation builder → certified citizen developer → technology-managed developer) with certification and revocation.
– Set guardrails for agentic AI and coding agents — least privilege, human confirmation before merge / deploy / delete, segregation of duties (AI never approves its own work), kill-switch, rate-limiting, rollback — and require secure-SDLC gates (SAST/SCA/secret-scan, prompt-injection testing) before release.
– Apply extra rigour to automation touching SAP / ERP or financial systems (transaction integrity, reconciliation, approval-before-posting), and oversee governance of agentic coding and collaboration tools (currently Claude Code and Cowork) as adoption grows.
• Own Monitoring, Incident Response & Audit Evidence:
– Define log sources, retention and SIEM-integrated alerting for AI/agent activity, and detect/remediate Shadow AI (unapproved tools or personal accounts).
– Own AI incident response with IT Security and the DPO — stop safely, preserve evidence, rotate credentials, notify within 4 hours, root-cause and remediate — with audit logs and evidence in place.
• Build Enablement, Training & Culture:
– Run the AI-governance training curriculum by audience (all staff, tool users, Technology, reviewers) and lead the BU AI Champion network as the central governance point of contact.
– Champion a “use AI fast, responsibly” culture, with adoption/risk metrics (active users, time saved, override rate, incidents) that never reward usage volume over safety or quality.
• Manage Vendor & Third-Party AI Risk:
– Assess AI vendors on data-usage terms, residency, certifications and DPAs; monitor model/API changes for control impact and keep an exit plan to avoid lock-in.
– Work with Procurement and Legal on AI contracts, DPAs and sub-processor oversight.
• Lead Governance, Audit & Stakeholders:
– Act as operational lead to the AI & Data Committee (risk reporting, escalations) and advise the MD/CTO on AI risk posture and investment priorities.
– Own the control-to-ITGC mapping (access, change, operations, backup/recovery, incident, vendor, segregation of duties, evidence retention) for audit readiness, validated with Internal Audit / Finance, and represent AI governance to auditors, regulators and partners.
Who are we looking for?
• Background: 10+ years in data governance, information security, risk & compliance, data privacy or technology governance, incl. 3+ years in a senior/leadership role — strong in both data and control / policy / governance.
• Privacy & AI-Risk Literate: Working knowledge of Thailand’s PDPA to partner effectively with the DPO, and solid understanding of AI/agentic AI risks (data leakage, hallucination, prompt injection, over-permissioned agents).
• Understands Financial Systems & Controls: Working understanding of SAP / ERP or equivalent financial-systems risk and of IT General Controls (ITGC) for audit-readiness mapping.
• Security-Fluent, Applied Concretely: Working command of identity & access, data protection, application/agentic security and incident response — with cloud (e.g., GCP) and network controls delivered with the Cyber Security team.
• Writes Policy That Gets Adopted: Proven ability to write clear, practical policy and turn it into workable, adopted controls.
• Influence Without Authority: Excellent stakeholder management across business, technology, legal, security and audit. Professional English; Thai preferred but not required.
• Nice to Have:
– Experience governing enterprise generative-AI (Claude, Copilot, Gemini / Vertex AI) and citizen-developer / RPA programs (e.g., Robot Framework).
– Familiarity with AI-assisted software development, DevSecOps, MCP, connectors and agentic-engineering controls.
– Certifications such as CIPP/CIPM, CISSP, CISM, CISA, CDMP, ISO 27001 / 42001 lead — a plus, not a substitute for hands-on experience.
– Background in retail, FMCG or multi-branch operations.
Why CJ Mart & TD Tawandang?
• Build It From the Ground Up: What you design becomes the AI governance system the whole group runs on.
• Real Scale, Real Stakes: Govern AI across two companies and a fast-growing retail network, with agentic tools already in use.
• Direct Exposure to Leadership: Work closely with the Head of BSX, the AI & Data Committee and the MD/CTO.
• High-Impact Runway: Your work decides how safely and how fast every colleague can use AI.
