• I'm Venky Chivukula — eighteen-plus years in technology, almost all of it in regulated environments: federal healthcare, mortgage finance, banking, and Amazon's ad business under GDPR. (pause)
• The throughline is building the systems that let an organization move fast and still prove it is compliant. Most recently, that has meant bringing AI into those systems — with a quality bar strict enough to hold up under external review. (pause)

Setting the Bar for AI Systems

• Today I'm Director of Technical Program Management at a global financial-services enterprise. I led the strategy, evaluation, and security governance for the AI agents we built for the incident and issue lifecycle — agents that detected risky changes and control drift before impact, triaged and routed issues with evidence attached, fixed known problems before they escalated, and verified each fix before closure. (pause)
• Before any agent was allowed to act, I aligned Security, Legal, and Core Engineering on one bar every AI system had to meet — consistency, accuracy, and auditability against real historical cases, with people approving anything that decided a compliance outcome. The same bar governed our AI coding assistants and AI code review, which cut legacy technical debt 70% and improved code quality 40%. (pause)
• I also led enterprise adoption of GenAI and LLM-based solutions on AWS to automate legacy workflows — AI doing the routine steps, people owning the outcomes.

Incidents Declining as Code Volume Rises

• At the bank, my focus was stopping risk incidents from escalating — even as engineers shipped far more change, with deployment lead time falling from two weeks to under 45 minutes. (pause)
• Proactive detection — AI agents reviewed every code, configuration, and infrastructure change before it shipped, and continuously checked running systems for controls that had stopped holding, so issues were caught before they caused impact. (pause)
• Automated triage — agents deduplicated issues, proposed severity, attached the evidence and likely cause, and routed each one to its owner in minutes instead of hours. (pause)
• Faster resolution — agents fixed known problems before they escalated, verified each fix, and assembled the closure evidence; and every confirmed root cause became a guardrail, so the next one was prevented automatically. (pause)
• Across those seven AI agents, the reactive SEV rate fell [X]% and time-to-close [X]%, contributing to a 40% drop in Sev-1/Sev-2 incidents — exactly the outcome the Incident & Issues Lifecycle team is aiming for.

Trusted Data from Many Authoritative Sources

• At the bank, I also led the consolidation of our compliance data — controls, applications, owners, live configuration, and audit evidence — into one connected model. (pause)
• Before, that data lived in five systems that often held conflicting records, and every audit started with weeks of reconciliation. We kept each system authoritative for what it owned, linked them with shared identifiers, and captured evidence automatically — so audit preparation fell from [X] weeks to [Y] days, and our risk agents worked from the same trusted data as our people. (pause)
• It's the same problem as Meta's compliance data and context work: many authoritative sources, one trusted way to reach them, and no tolerance for a wrong answer.

Change Management: Authored Once, Enforced Everywhere

• At Amazon, I spent four years as a Principal TPM across AWS and Amazon Ads. There, I worked on the GDPR program for the Prime Video advertising rollout in European markets — where personal data flowed through ad targeting and measurement, across internal teams and third-party partners, at 120M+-user scale. (pause)
• We made each GDPR requirement canonical — one owner, one definition, one technical control — and wrote the controls once into the shared APIs and SDKs every integration inherited: consent travelling with every ad request, data minimization by contract, and deletion requests fanning out to every partner holding the data. (pause)
• The controls were launch gates, so no market went live half-enforced — and changing a requirement was one change, not one per team or partner. That's the Change Management problem Risk Foundations owns: a requirement authored once, reaching every system that enforces it.

Capacity, Spend & Standardization at Scale

• At AWS, I ran AI and GPU capacity planning — compute, networking, quota, and workload placement — across 3 Availability Zone launches, with zero Sev-1 readiness-related incidents in the first 30 days after GA. (pause)
• And at the bank, I applied the same discipline to our AI agents: I standardized them across most of our risk and compliance domains on one agent harness, one execution trace, one quality bar, and one issue model — each domain brought only its own detection rules — so new domains onboarded in [X] weeks instead of building from scratch. I managed inference spend like capacity, too: cost per agent task tracked against the on-call time it replaced, cutting inference cost per resolved issue [X]%. Standardize first, unify second, then let AI lead.

Fit

• What draws me to Risk Foundations is that it's rebuilding risk and compliance systems AI-native from the ground up — AI leading, human experts supporting. (pause)
• I've spent my career on the two halves of that: regulated systems where correctness is non-negotiable, and AI governance that makes automation trustworthy enough to rely on.

Closing

• I'd love to bring that to whichever area fits best — making risk incidents decline as code volume rises, making every AI system meet the bar with evidence an external reviewer can check, or making a compliance requirement change once and reach every system that enforces it.