Senior Software Engineer, AI Governance

Natera is a global leader in cell-free DNA testing for oncology, women’s health, and organ health. The Senior Software Engineer, AI Governance will build and operate technical AI governance systems, including LLM guardrails, risk intake and scoring, monitoring, observability, and incident response tooling. The role also leads governance reviews, vendor AI due diligence, and engineering enablement across Legal, Privacy, RAQA, platform engineering, and business teams.

Responsibilities:

• Design, build, and own the guardrail layer inside Natera's LLM Gateway: content filtering, output validation, PHI/PII detection, prompt injection defenses, session retention, and audit logging. You write the code; you own the component
• Engineer the governance layer for Natera's agentic runtime and RAG infrastructure: policy enforcement hooks, output routing by risk tier, retrieval filtering, citation integrity checks, and PHI exposure prevention
• Ensure every control is instrumented with observability from day one: what is filtering, what is flagging, what is escalating, and what is drifting from its approved risk profile. Governance without observability is not governance
• Ensure every AI platform control meets HIPAA, RAQA, and Natera's data classification requirements at design time. Retrofitting after deployment is not an option
• Build governance as a runtime capability: the platform enforces policy; you define what that policy is, implement it, and verify it works under real conditions
• Design and implement the automated AI risk intake pipeline: structured intake form, automated risk scoring, tiering (Low / Medium / High / Critical), and routing to the right review path, aligned to NIST AI RMF, CHAI, and the EU AI Act
• Build and maintain the AI Risk Register as an engineering artifact: risk scores, treatment decisions, mitigation steps, and review history, queryable and auditable
• Define and build the monitoring systems for every production AI use case: accuracy tracking, drift detection, misuse alerting, and escalation thresholds. These must be instrumented and verified before go-live, not documented and hoped for
• Build and maintain the AI incident response tooling: automated detection, alert routing, decision logging, and remediation tracking
• Run the AI use-case intake process end to end: evaluate every new use case against the risk tiering model before it gets built or deployed, using the automated systems you built
• Facilitate high-risk use-case reviews with the AI Governance Board (Legal, Privacy, RAQA) and produce clear, time-bound recommendations and controls. Flagging the problem is not enough
• Keep the risk questionnaire, scoring rubric, and tiering criteria current as the AI portfolio scales and applicable frameworks, regulations, and internal policies change
• Own the technical due diligence process for AI vendors and foundation model providers: evaluate data residency, model transparency, API security, contractual controls, and regulatory alignment before any external AI system connects to Natera data or workflows
• Maintain the vendor AI risk assessment framework; ensure contracts include AI-specific provisions on data handling, model versioning, and auditability. A completed technical assessment is required before any vendor or model goes into production
• Help write and maintain Natera's AI acceptable-use policy, grounded in what the platform actually enforces rather than aspirational guidelines
• Be the practical engineering resource teams call when they are building something new and need to understand what governance requires: not just the person who says no, but the person who shows them how to build it right