Robert Saghafi

INTRODUCTION

Data governance and sensitive data protection have been the foundation of my work for over a decade in regulated financial services and the aviation industries. The discipline required to govern data at enterprise scale — knowing where it lives, how it moves, who owns it, and how it must be protected — is the same discipline that makes AI governance possible. You cannot responsibly govern AI without first governing the data it depends on.

I am Robert Saghafi — a Data and AI Governance Architect with deep expertise in sensitive data protection, AI risk management, and enterprise governance program design. I operate at the intersection of three disciplines most practitioners treat separately: data governance, information security, and AI governance. My work sits precisely where all three converge.

WHAT I DO

Data and AI Governance Architecture
I design end-to-end governance architectures that make AI adoption trustworthy, compliant, and sustainable in regulated environments. That means building the structures that underpin responsible AI — Use Case Inventories, risk-tier classification frameworks, Shadow AI remediation programs, and intake governance processes aligned with NIST AI RMF, EU AI Act, ISO 42001, and DORA. Frameworks only create value when translated into enforceable operational controls. I design the architecture and engineer the solutions that make that happen.

Sensitive Data Protection and DSPM
I build defensible data protection architectures spanning Data Security Posture Management (DSPM), Data Loss Prevention (DLP), data classification, and sensitive data lifecycle governance across multi-cloud environments. At Northern Trust, I designed and led a $3.3M enterprise data protection and governance program for 30,000 users across seven global business units — building classification frameworks, protection controls, and governance monitoring capabilities that provided the organization with the foundation to enable AI use cases across business activities at scale.

AI Risk Management and Observability
I architect AI observability guardrails and Model Risk Management controls for deployed generative AI and agentic workflows — addressing prompt injection, data exfiltration, privilege escalation, and model manipulation vectors. I design governance programs that keep AI systems auditable, observable, and compliant from deployment through production.

Data Governance Advisory
I partner with data engineering, security, and executive teams to translate complex regulatory and business requirements into actionable governance roadmaps. Whether designing a data catalog strategy, operationalizing data owner accountability, or building the governance forum structures that sustain a program in the long term, my focus is always on governance that is actually adopted — not just documented.

INNOVATION AND RESEARCH

I hold a pending patent related to sensor-fusion data integrity for autonomous systems — reflecting my broader focus on trustworthy autonomy, resilient system design, and the governance of AI systems operating in safety-critical environments.

I am completing an M.S. in Uncrewed and Autonomous Systems Engineering at Embry-Riddle Aeronautical University (Expected 2026), with a focus on autonomous system architecture and AI security, which directly informs my approach to agentic AI governance in safety-critical environments.

Certifications: CISM · CCSK v5.0 · CCZT · TAISE · CDMP · Oracle Certified Generative AI Professional · SAFe 6 Agile PM · CSPO

LET'S CONNECT

I partner with organizations that want data and AI governance to accelerate adoption, not block it.

Whether you are standing up an enterprise AI governance program, architecting sensitive data protection across a complex platform environment, navigating Shadow AI risks, or seeking a governance architect who understands data, AI, and information security simultaneously — I welcome the conversation.