Senior Subject Matter Expert (SME) - AI Governance & Security Policy

About the role

RESULTS. INNOVATION. VALUES. ACCOUNTABILITY.

That's RIVA.

We're a mission-driven IT services company and systems integrator supporting digital transformation and modernization for federal government agencies. Since 2009, we've partnered with our customers to solve complex challenges through smart, practical innovation to deliver real outcomes where they matter most. Our teams are made up of industry-leading experts who are passionate about doing great work and making a difference. We don't just develop solutions, we support efforts that strengthen communities and serve the public good.

RIVA's culture is built on four core values: Results, Innovation, Values, and Accountability. They guide how we work, how we collaborate, and how we measure success. Our employee-first approach is rooted in trust, ownership, and meaningful work. By investing in our people and fostering a flexible, supportive environment, employees have the opportunity to grow their skills, contribute ideas, and make an impact from day one. all while supporting missions that matter.

Position Overview

Riva

Solutions is seeking a Senior Subject Matter Expert (SME) specializing in AI governance, federal data security policy, and regulatory compliance. This SME provides highly specialized expertise to guide the agency's responsible adoption of AI across its four AI planes-Data, Development, Serving, and Control-and establishes defensible governance frameworks aligned with NIST AI RMF, OMB M-25-21, CISA BOD 26-04, and CISA 2026 agentic AI guidance. The candidate owns the Compliance and Reporting objective (SOO 4.1.4) and co-owns AI Governance and Protection (SOO 4.1.2) as a primary contributor.

Core Responsibilities

• Shape and maintain the AI governance framework for the USPTO, applying NIST AI RMF Govern, Map, Measure, and Manage functions to the agency's generative AI adoption across AWS Bedrock, AWS SageMaker, M365 Copilot, and other frontier AI platforms
• Translate OMB M-25-21 (AI in Federal Government), CISA BOD 26-04, and CISA 2026 agentic AI guidance into actionable use-case playbooks, acceptable-use policies, and enforcement configurations for the UGAP API service broker and AWS Bedrock Guardrails
• Define and maintain the policy-based enforcement matrix governing allow, block, alert, redact, and route actions across AI platforms routed through the UGAP broker, ensuring each approved use case moves from monitor-only baseline to graduated enforcement with documented Product Owner approval
• Oversee the governance of the four AI planes: Data (Databricks/Unity Catalog classification coverage), Development (GitLab pipeline artifact security, Snyk Agent Scan findings), Serving (UGAP broker enforcement, Bedrock Guardrails inline controls), and Control (Wiz policy engine, Netskope CASB DLP rules, Okta ICAM access governance)
• Develop and maintain the AI Governance and Enforcement Configuration, specifying use-case approval criteria, enforcement escalation paths, and Model Context Protocol (MCP) artifact governance policies to address agentic AI security risks
• Lead the Compliance, Reporting, and Remediation objective: design the three-tier evidence chain (operational, compliance, executive) that flows from XSIAM and QRadar SIEM telemetry into AWS CloudWatch and S3-based reporting outputs, terminating in the COR-reviewed dashboard deliverable
• Advise on the treatment of sensitive data categories-PII, confidential patent and trademark data, credentials, and export-controlled content-within AI workflows and ensure classification rules reflect agency risk appetite
• Represent the program at senior stakeholder briefings, governance forums, and monthly COR reviews; translate complex AI policy and security posture data into executive-ready findings
• Assess emerging agentic AI risks-autonomous tool-use chains, multi-agent orchestration, and MCP server exposure-against CISA 2026 guidance and recommend programmatic responses

Minimum Qualifications

• Bachelor's degree and 10 years of relevant experience, or Master's degree and 8 years of relevant experience in cybersecurity, information assurance, AI policy, or a related field
• Recognized expertise in federal AI governance frameworks, including NIST AI RMF, OMB M-25-21, and CISA agentic AI guidance; ability to operationalize policy mandates as technical enforcement configurations
• Deep familiarity with NIST SP 800-53, FISMA, and FedRAMP requirements as applied to AI serving infrastructure (AWS Bedrock, SageMaker) and API brokering platforms
• Experience designing AI policy enforcement controls using CASB (e.g., Netskope), API gateway brokering patterns, or inline guardrails (e.g., AWS Bedrock Guardrails)
• Experience advising senior government officials and program offices on AI adoption risk, data security policy, and compliance reporting requirements
• Demonstrated ability to translate regulatory requirements into actionable technical and operational guidance deliverable within a structured federal program
• Technical literacy across the enforcement stack the governance framework directs: generative AI and LLM concepts (prompting, retrieval-augmented generation, model routing, system prompts), API gateway policy enforcement patterns, DLP rule logic, and policy-as-code practices with versioned policy definitions maintained in Git

Preferred Qualifications

• Prior work at or with a federal civilian agency on AI adoption, responsible AI frameworks, or enterprise AI governance programs tied to OMB or CISA mandates
• CISSP, CISM, or equivalent senior cybersecurity credential; familiarity with AI governance certifications or NIST AI RMF practitioner community
• Experience governing AI platforms such as AWS Bedrock, Azure OpenAI Service Government, or similar frontier model environments in a federal context
• Familiarity with Model Context Protocol (MCP) security risks, agentic AI orchestration patterns, and CISA 2026 agentic AI guidance
• Published work, conference presentations, or recognized contributions to federal AI policy, responsible AI, or cybersecurity governance communities
• Familiarity with AI security testing and evaluation practices: prompt injection and jailbreak red-teaming, data exfiltration testing for AI channels, and AI usage telemetry as governance evidence

Pay and benefits

The salary or salary range for this role reflects an estimated range informed by multiple compensation factors. Final offers may vary based on considerations such as relevant experience, education and training, critical skillsets, and overall business needs.