# The Jobs of 2036: Nine Careers That Will Emerge as Risk, AI and Governance Are Reinvented
By 

## Article Content
What happens to your profession when machines can make decisions, rewrite their own controls, execute regulations and audit themselves? A look ten years into the future reveals some surprising new responsibilities. In August 2026, I delivered a keynote at the Institute of Internal Auditors and ISACA GRC Conference on a challenge I have been tracking for years: the world is changing faster than many organizations can understand, manage and govern it. I wrote a post about my keynote and emerging risk here in the context of the security issues that emerged last week. I began by looking back at the 2016 conference, then examined the issues confronting the profession in 2026. The contrast was remarkable. In 2016, data science was emerging as a new skill for auditors. By 2026, we were debating who should audit an autonomous machine's authority to act. I identified ten types of audit responsibility that had appeared on the career map, from agentic AI assurance and machine identity to evidence provenance and digital resilience. Some are job titles; others are rapidly emerging duties. All reflect a fundamental shift in what needs to be governed. Then I took the audience forward another ten years. I created a fictional agenda for the 2036 GRC conference, with nine imagined sessions and presenters. These were not announcements of a real event or guaranteed forecasts of future job titles. They were thought experiments based on changes already underway. My question was simple: What jobs become necessary when the systems we are supposed to audit can act, decide, adapt and sometimes govern themselves? 1. The Machine Has Power of Attorney The emerging role: Autonomous Authority Auditor Imagine an AI agent negotiating a supply agreement with another agent, committing funds and accepting contractual terms without anyone clicking an approval button. The risk is no longer limited to whether the system reaches the right conclusion. It extends to what the system is authorized to do with that conclusion. The phrase "power of attorney" is a metaphor for delegated authority, not a claim about an AI agent's current legal status. Someone will have to define, test and continuously verify those boundaries. Can a machine spend $500 or $5 million? Can it change suppliers, make commitments or pass authority to another agent? How quickly can its permission be revoked? The Autonomous Authority Auditor will examine how machine rights are granted, constrained, documented and challenged. Traditional access audits ask who can enter a system. This new role asks a far more consequential question: Who gave the machine the right to say yes? 2. The Audit Happens Before the Decision The emerging role: Pre-emptive Assurance Architect Traditional audit frequently looks backward. A transaction occurs, and someone later determines whether it met policy. But autonomous systems can make thousands of consequential decisions before a human reviewer has opened a dashboard. In that environment, discovering a failure after the fact may be far too late. By 2036, assurance could be embedded directly into the moment of action. Before an agent commits money, shares sensitive information or changes a production setting, the proposed action could pass through real-time risk assessment, policy checks and an assurance gate. Permission would be granted, escalated or denied before anything happened. The Pre-emptive Assurance Architect would design and test those gates, ensuring they are reliable rather than automated rubber stamps. This job emerges because assurance must increasingly shape the permission to act, not merely review the consequence. 3. The Control That Rewrote Itself The emerging role: Adaptive Controls Auditor Controls have traditionally been defined, documented, approved and updated through a deliberate process. But AI can detect changing conditions, find weaknesses and recommend adjustments much faster than a conventional change-control cycle. Imagine a system that tightens permissions when threats emerge, revises thresholds or redesigns a monitoring rule following an automated security test. That creates an entirely new assurance problem. What if the learning system improves a control but also creates a hidden exception? What if it optimizes for efficiency while quietly reducing safety? The Adaptive Controls Auditor will review not only the control, but the mechanism allowed to change it. Which boundaries cannot move? Who approves major revisions? Can a harmful change be rolled back, and can the earlier state be reconstructed? The next generation of audit will need to assure the systems that rewrite the controls themselves. 4. Prove This Reality The emerging role: Chief Data Provenance Officer or Evidence Authenticity Auditor Auditing depends on evidence. Yet generative AI is making convincing video, voice, documents and other digital records easier to fabricate or manipulate. Imagine an apparently authentic executive instruction, video testimony or system record presented to support a major decision. The first question may no longer be what that material proves. It may be whether it can be trusted at all. The Chief Data Provenance Officer and future authenticity specialists will establish how evidence can be traced to its source and through every subsequent transformation. Cryptographic signatures, chain-of-custody records, identity verification and independent validation may become routine elements of assurance. None is a magical guarantee of truth, so the surrounding process must also withstand scrutiny. When reality can be convincingly manufactured, provenance becomes the control. 5. Your Company Ends Nowhere The emerging role: Ecosystem Risk Strategist Organizations may have legal boundaries, but their operational boundaries are becoming increasingly difficult to define. A single transaction can pass through a customer's automated assistant, an outside data provider, a cloud service, a distributor's procurement agent and several suppliers. Each may contribute to the decision, and each may create a point of failure. When something goes wrong, whose control failed? Who owns the evidence, the decision and the responsibility? The Ecosystem Risk Strategist will connect third-party risk, cyber assurance, supply-chain dependencies and the governance of agents acting across multiple organizations. This professional will assess relationships and failure pathways rather than stopping at the company's own perimeter. The job emerges because risk follows relationships, not ownership. Increasingly, the thing we must audit is the ecosystem, not just the enterprise. 6. The Law That Executes Itself The emerging role: Executable Regulation Assurance Specialist Today, regulation is interpreted by legal teams, translated into policies, implemented through systems and eventually checked for compliance. Each handoff takes time and introduces the possibility of misunderstanding. Now imagine more requirements being published or translated into machine-readable rules that systems can ingest, map to controls and use to test transactions continuously. The result would not be laws literally enforcing themselves. Legal interpretation, competing obligations and human accountability would remain. But far more compliance activity could become software-driven. The Executable Regulation Assurance Specialist would examine whether legal obligations were translated accurately, whether jurisdictional exceptions were handled and whether automated enforcement remained explainable and challengeable. This new role arises because the code that implements a regulation may become as important to audit as the written policy itself. 7. Audit the Future Through Simulation The emerging role: Simulation and Resilience Assurance Engineer Too many organizations discover the limitations of their resilience during an actual crisis. A cyberattack combines with a cloud outage, a supply failure or a disruption to critical infrastructure, producing consequences nobody fully anticipated. Conventional testing can evaluate defined scenarios, but advances in digital twins, simulation and AI may allow organizations to explore vastly more combinations before an event occurs. The Simulation and Resilience Assurance Engineer will evaluate those simulated futures and, just as importantly, challenge the models behind them. Were the assumptions realistic? Which dependencies were missed? Do impressive resilience scores conceal vulnerabilities? The job is not to predict every catastrophe, which is impossible. It is to help organizations learn from credible simulations and prepare for cascading failures before they happen. The safest catastrophe is the one we encounter in simulation and prevent in reality. 8. When Risk Gets a Body The emerging role: Physical AI Assurance Director Much of today's AI risk discussion focuses on information: the answers a model produces or the decisions it recommends. But AI is also moving into robots, vehicles, factories, warehouses and infrastructure systems capable of acting in the physical world. A software failure is no longer necessarily a bad answer on a screen. It may damage equipment, disrupt a process or harm a person. The Physical AI Assurance Director will combine elements of cybersecurity, operational safety, robotics and AI governance. This role will scrutinize sensor reliability, unexpected behavior, safety limits, human overrides and whether a machine's actions can be reconstructed after an incident. Existing safety engineering provides an essential foundation, but greater autonomy makes the assurance challenge more complex. We will have to audit what the machine actually did, not simply what it decided. 9. The Last Human Auditor The emerging role: Human Accountability and AI Assurance Leader For my final fictional 2036 session, I put a robot on stage as the keynote speaker. Its name was AURORA-7, and its topic was The Last Human Auditor. This was deliberately provocative, not a prediction that human auditors will disappear by 2036. Autonomous systems may increasingly collect and reconcile evidence, monitor transactions, identify exceptions, test controls and draft assurance reports. That could remove enormous amounts of repetitive work. Yet the resulting need for independent challenge, ethical judgment and accountable leadership becomes greater, not smaller. The human assurance leader must recognize when automated conclusions are wrong, determine which decisions should never be delegated and ensure someone remains responsible when an autonomous system causes harm. In my imagined future, the robot might deliver the session. It does not get to absolve the organization of accountability. Human oversight isn't the obsolete part of the system. It is the part that must become more capable. The Real Story Is Not Nine New Job Titles. It Is a Profession Being Rewritten. These nine roles are scenarios, not guaranteed entries in a 2036 employment directory. Some titles may never exist. Others may be combined, distributed across teams or carried out jointly by people and machines. But the forces creating the work are already visible: autonomous authority, changing controls, synthetic evidence, interconnected organizations, software-driven compliance, simulation and physical AI. That was the larger argument of my keynote. In 2016, the profession was talking about audit at the speed of risk. In 2026, the challenge had become governance at the speed of risk. Looking toward 2036, I suggested a new reality: governance at the speed of machines. The challenge is not simply teaching auditors to use the next wave of software. It is redefining what must be assured, when assurance should happen, where responsibility begins and ends, and which judgments require human accountability. That will demand people who can work across technology, law, operations, security and ethics. It will also demand a different approach to learning. Qualifications and experience will still matter, but static expertise has a shrinking shelf life. The most successful professionals will be those who become structurally better at exploring unfamiliar technologies, experimenting with new approaches, continuously learning and anticipating the risks that do not yet have familiar names. Perhaps the most important question about the jobs of 2036 is not whether these nine titles prove accurate. It is whether today's organizations and professionals are preparing for the responsibilities behind them. You cannot slow the future of risk down. Y ou have to make governance capable of keeping up.                

---
Source: https://jimcarroll.com/2026/10/the-jobs-of-2036-nine-careers-that-will-emerge-as-risk-ai-and-governance-are-reinvented/