Team, Roles & Skills
The bench that runs the standard today — and the named roles the delivery org hires to scale the process past its founders.
Confidential · June 2026. The current bench is real and named. The scaling roles below are the org we intend to staff as engagement volume grows — they are target roles, not filled seats. Compensation, headcount, and timing are illustrative planning placeholders, not commitments. The independence separation described is an intended structure; govrn is pre-entity today, so it is a design constraint we are building toward, not an operating fact.
How to read this
govrn delivers a repeatable arc — Assess → Design → Implement → Operate → Attest → re-baseline — and a repeatable process is only as durable as the people who can run it without the founders in the room. This document has two parts. First, the current bench: who does what now. Second, the delivery org as it scales: the named roles we hire, what each owns, the skills and frameworks they must hold, and the govrn certification level each requires before they touch a client record. The throughline is independence — the body that builds and runs is structurally separate from the body that attests, and that line runs through the org chart, not just the brand.
Part 1 — The current bench
Five people carry the standard, the engine, and the go-to-market today. Roles are concentrated by necessity; that concentration is exactly what the scaling org below relieves.
| Person | Role | Owns |
|---|---|---|
| Richard Taubin | Founder | The govrn standard, the brand, GTM, and the engagement model — the three-lens assessment, the crosswalk discipline, and the attestation premise. |
| Joe Saba | Principal Architect | The Aperture engine — deterministic measurement, metadata-only collection, shadow-AI surfacing, cost attribution. The system of record. Enterprise architecture and integration patterns across client deployments. |
| Chris Bennett | CTO | Enterprise infrastructure, Azure, and top-level Microsoft relationships — connectors, identity, and the deployment posture inside real client estates. Enterprise lead architect at TTEC Digital; leads govrn's enterprise cloud, data & infrastructure delivery — the discovery and platform at the highest enterprise level. |
| Roberto Lleras | CSO | Data science and AI — the analysis layer over the record, model-risk framing, and the AI-lens depth behind product-AI review. Enterprise lead architect at TTEC Digital; the enterprise data + AI platform depth behind delivery. |
| Sean Barlow | Solutions Architect | Design and Implement stages — how the standard maps onto a specific client estate; integration patterns, sequencing, and the target operating model. Full-stack and AI engineering surfaces and tooling. Enterprise lead architect at TTEC Digital; enterprise integration + implementation of the discovery and platform. |
| Amit Tank | AI/ML/Infrastructure | AI/ML systems and infrastructure — model deployment, observability, and the technical foundation for governance measurement and compliance. |
| Sean Dougherty | SysOps | Systems operations, infrastructure stability, and deployment automation — the operational reliability that keeps the measurement path deterministic and client environments secure. |
Enterprise delivery — the TTEC Digital architects. Chris Bennett, Roberto Lleras, and Sean Barlow are enterprise lead architects at TTEC Digital — Microsoft's 2025 Dynamics 365 Service Partner of the Year and a 10-year Microsoft Inner Circle member (10,000+ Microsoft projects, 1,400+ certifications; deep Azure, Fabric, Dynamics 365 and Copilot). They bring top-level Microsoft relationships and lead govrn's enterprise cloud, data, and infrastructure delivery — overseeing the discovery and platform implementation at the highest enterprise level. The play: govrn.ai as the lead enterprise brand, with a Microsoft-platform solution first (a Microsoft co-invest through these architects' senior relationships), then AWS and Google — the same architects carry all three. They partner in from TTEC Digital as the enterprise-delivery team.
The premise is explicit: we will have more people. The roles above are doing the work of the roles below until those roles are staffed.
Part 2 — The delivery org as it scales
As engagement volume grows, the work decomposes into named roles. Each is defined by what it owns, the skills and frameworks it must hold, and the minimum govrn certification level. Certification levels tie directly to the training and certification track — no one operates above the level they have earned.
| Role | Owns | Required skills & expertise | Frameworks they must know | Min. govrn cert |
|---|---|---|---|---|
| Lead Assessor | The three-lens assessment (Technology, Security, AI) and product-AI review for an engagement; assessment quality and scope discipline. | Audit methodology, control testing, evidence collection, interviewing technical and executive stakeholders, scoping. | NIST AI RMF, ISO/IEC 42001, CSF 2.0, OWASP, plus working fluency in all six crosswalks. | govrn Certified Assessor (L3) |
| Governance Engineer | The Aperture deployment for a client — connectors, metadata-only collection, shadow-AI surfacing, cost attribution; keeps the measurement path deterministic. | Policy-as-code (OPA/Rego), OSCAL authoring, OpenTelemetry, data lineage (Atlas/Marquez), SIEM routing, IdP/SCIM, secrets-vault integration. | NIST AI RMF, MITRE ATLAS, OWASP; OSCAL as the evidence format. | govrn Certified Engineer (L3) |
| Solutions Architect | The Design and Implement stages — how the standard maps onto a specific client estate; integration patterns, sequencing, and the target operating model. | Enterprise architecture, identity, cloud (Azure-forward), connector design, LLM observability (Langfuse), risk-based prioritization. | ISO/IEC 42001, EU AI Act applicability, NIST AI RMF, CSF 2.0. | govrn Certified Architect (L4) |
| Delivery Lead | The engagement end-to-end — scope, timeline, stakeholders, the annuity loop (re-baselining cadence), and client outcomes against the arc. | Program management, client management, governance-domain fluency, commercial judgment, the full Assess→Operate motion. | All six crosswalks at a literacy level; EU AI Act obligations; ISO/IEC 42001 lifecycle. | govrn Certified Architect (L4) |
| Attestation Lead | Independent attestation — issuing an attestation only against a fresh record, and only where evidence supports it. Reports apart from build and delivery. | Assurance and attestation practice, independence and conflict management, evidence sufficiency judgment, defensible documentation. | ISO/IEC 42001 (audit posture), NIST AI RMF, CSF 2.0, EU AI Act conformity logic. | govrn Certified Attestor (L4, independence-cleared) |
| Standard/Crosswalk Owner | The govrn standard itself — the six-framework crosswalk library, version control of the controls, and how regulatory change propagates into the assessment. | Regulatory tracking, control taxonomy design, framework mapping, technical writing, change governance. | Deep mastery of NIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP, MITRE ATLAS, CSF 2.0. | govrn Certified Architect (L4) |
Independence is an org-chart fact, not a slogan
The Attestation Lead — and the attestation function beneath that role — does not report into delivery, engineering, or the founder line that owns GTM. An attestation is the one output govrn cannot let its own delivery incentives touch. Build and run sit on one side (Governance Engineer, Solutions Architect, Delivery Lead, the engine itself); attest sits on the other (Attestation Lead, independence-cleared). The Grace Hill engagement — where we model an assumed internal estate around their shipped "Gracie" assistant — is exactly the kind of work where that separation has to hold: the same firm cannot both design Grace Hill's controls and certify that they pass.
Why this is how we scale
The founders prove the process works; the named roles make it repeatable without them. Each role has a defined ownership boundary, a skills floor, a framework requirement, and a certification gate — which means we can hire against a specification, train against a curriculum, and staff an engagement from a bench rather than from heroics. That is the difference between a consulting practice that depends on five people and a standard that an org can run at volume.