Skip to content
§ 05 — Careers

AI Evidence Archaeology Team

The AI Evidence Archaeology team reconstructs the technical, human, financial, and decision history of enterprise AI systems when the organization lacks a complete, reliable, or standardized record.

The team identifies where AI entered the organization, what systems and data it touched, what evidence remains, what evidence was never captured, and whether the company can reconstruct what it purchased, how it operated, what value it produced, and what exposure remains.

The team does not begin by calculating financial loss. It begins by establishing what happened and what can still be proved.

§ 05.a

The team's work supports

  • AI Investment Forensic Analytics
  • AI Asset and Expenditure Reconstruction
  • AI portfolio rationalization
  • Asset impairment analysis
  • Vendor and contract restructuring
  • Regulatory or litigation response
  • AI Capital Recovery
§ 05.b

Open positions

P.01

Lead AI Evidence Archaeologist

Principal investigator and engagement lead. Directs the investigation, defines the evidence universe, tests competing explanations, and converts fragmented findings into a defensible reconstruction of the AI initiative.

a — Core responsibilities

What the role does

  • Establish the scope and chronology of the AI initiative or portfolio.
  • Identify formal, embedded, experimental, and shadow AI use.
  • Determine which business units, vendors, employees, systems, models, and workflows must be examined.
  • Develop the investigation plan and evidence-request schedule.
  • Conduct interviews with executives, business owners, procurement, finance, IT, legal, compliance, security, data teams, and end users.
  • Compare the approved operating model with actual employee behavior.
  • Identify contradictions among management statements, system records, financial records, and user accounts.
  • Determine which facts are confirmed, inferred, disputed, missing, or unrecoverable.
  • Direct the construction of an AI initiative chronology.
  • Maintain an evidence-gap register.
  • Define the boundaries of any financial or operational analysis that follows.
  • Present findings to boards, audit committees, CFOs, restructuring teams, counsel, and investors.
  • Ensure that conclusions do not exceed what the evidence can support.
b — Experience that helps

Where candidates may come from

Strong candidates may come from:

  • forensic investigations
  • regulatory examinations
  • banking resolution or receivership work
  • corporate restructuring
  • internal audit
  • fraud examination
  • e-discovery
  • complex litigation support
  • operational due diligence
  • enterprise risk
  • government oversight
  • investigative journalism involving data and institutions
  • large-scale records reconstruction after mergers, failures, or system conversions

Experience working with incomplete, inconsistent, or adversarial records is more valuable than experience producing routine compliance reports.

c — Required skills

Required skills

  • Investigative interviewing
  • Hypothesis development and testing
  • Evidence scoping
  • Timeline reconstruction
  • Contradiction analysis
  • Documentation discipline
  • Executive communication
  • Institutional process analysis
  • Data literacy
  • AI systems literacy
  • Financial and operational literacy
  • Ability to distinguish fact, inference, allegation, and assumption
  • Ability to work through ambiguity without prematurely simplifying the case
d — Preferred qualifications

Preferred qualifications

  • Ten or more years in investigations, audit, restructuring, regulatory work, litigation support, or enterprise risk
  • Experience presenting findings to senior executives, boards, regulators, or counsel
  • Familiarity with generative AI, retrieval-augmented generation, copilots, AI agents, enterprise software, and cloud platforms
  • Experience working alongside data analysts, engineers, accountants, attorneys, and cybersecurity specialists
  • Certifications may include CFE, CIA, CPA, CISA, CAMS, or similar — certification is not a substitute for investigative judgment
e — Primary deliverables

Primary deliverables

  • Investigation scope
  • AI systems and stakeholder map
  • Evidence-request plan
  • AI initiative chronology
  • Evidence-gap register
  • Contradiction and uncertainty log
  • Preliminary findings memorandum
  • Evidence recoverability classification
  • Executive and board presentation
APPLYP.01 — Lead AI Evidence ArchaeologistInclude a résumé and a short note on records you have had to reconstruct.
P.02

AI Systems and Provenance Archaeologist

Reconstructs how AI systems operated inside the enterprise — which models, platforms, applications, connectors, permissions, indexes, agents, APIs, data sources, and workflow dependencies shaped AI interactions over time. Technical provenance rather than model development.

a — Core responsibilities

What the role does

  • Identify all AI-enabled systems used within the investigation scope.
  • Distinguish formally approved AI from embedded, experimental, personal, and shadow AI.
  • Map relationships among enterprise applications, model providers, APIs, plugins, connectors, agents, and data repositories.
  • Determine which model names and versions can be identified.
  • Examine configuration histories, administrator records, audit logs, application logs, API records, identity records, and access-control changes.
  • Reconstruct how prompts were enriched, routed, grounded, retrieved, transformed, or passed between systems.
  • Determine what enterprise data was available to users and systems at relevant points in time.
  • Identify model drift, retrieval drift, permission drift, workflow drift, and configuration drift.
  • Determine whether prior outputs can be reproduced, traced, partially inferred, or not reconstructed.
  • Identify evidence-retention limits and expired logs.
  • Map technical dependencies that may prevent a system from being terminated or replaced.
  • Document uncertainty where providers or internal systems do not expose sufficient information.
  • Preserve technical evidence in coordination with legal, cybersecurity, and records teams.
b — Experience that helps

Where candidates may come from

Strong candidates may come from:

  • enterprise architecture
  • cloud engineering
  • identity and access management
  • cybersecurity investigations
  • digital forensics
  • AI observability
  • data engineering
  • platform engineering
  • Microsoft 365, Azure, AWS, Google Cloud, Salesforce, ServiceNow, or similar enterprise environments
  • model operations or machine-learning operations
  • API integration and application architecture
  • e-discovery technology
  • incident response
  • software configuration and change management

Experience building frontier models is not required. The stronger candidate is often the person who can trace how systems, permissions, data, users, and vendors interacted inside a complex enterprise environment.

c — Required skills

Required skills

  • Enterprise systems mapping
  • Cloud-platform literacy
  • Identity and permissions analysis
  • Log analysis
  • API and connector analysis
  • Data-lineage reconstruction
  • AI architecture literacy
  • Retrieval-augmented generation literacy
  • Model and configuration versioning
  • Technical evidence preservation
  • System-dependency analysis
  • SQL
  • Basic Python or equivalent scripting
  • Ability to explain technical findings to nontechnical investigators and executives
d — Preferred qualifications

Preferred qualifications

  • Seven or more years in enterprise systems, cloud architecture, cybersecurity, data engineering, digital forensics, or AI operations
  • Experience with Microsoft Purview, Microsoft Graph, Entra ID, cloud logging, SIEM systems, data catalogs, or comparable tools
  • Familiarity with prompt logs, model routing, embeddings, semantic indexes, retrieval systems, agents, and AI orchestration
  • Familiarity with forensic acquisition, chain of custody, legal holds, and evidence preservation
  • Relevant certifications may include CISA, CISSP, cloud architecture credentials, digital-forensics credentials, or vendor-specific enterprise certifications
e — Primary deliverables

Primary deliverables

  • AI systems inventory
  • Enterprise AI architecture map
  • Model and vendor inventory
  • Data-source and connector map
  • Identity and permission chronology
  • Technical dependency map
  • Log and evidence availability assessment
  • Drift analysis
  • Reproducibility and traceability assessment
  • Technical provenance memorandum
APPLYP.02 — AI Systems and Provenance ArchaeologistInclude a résumé and a short note on records you have had to reconstruct.
P.03

AI Data Reconstruction and Forensic Analytics Archaeologist

Converts fragmented technical, financial, procurement, operational, and human evidence into a standardized, analysis-ready AI portfolio record. Builds the authoritative dataset required for valuation, impairment, restructuring, recovery, or further forensic accounting.

a — Core responsibilities

What the role does

  • Inventory source systems and data owners.
  • Collect and reconcile procurement, licensing, consulting, implementation, cloud, compute, labor, and vendor records.
  • Normalize inconsistent vendor, project, model, department, employee, and cost-center names.
  • Link financial records to AI systems, business units, workflows, contracts, and decision owners.
  • Reconstruct total expenditure where costs were distributed across multiple departments or accounts.
  • Compare approved budgets with recorded and inferred expenditures.
  • Identify duplicated tools, overlapping vendors, inactive licenses, abandoned pilots, and unallocated cloud costs.
  • Reconstruct expected ROI from business cases, presentations, board materials, and approval records.
  • Compare promised outcomes with actual financial and operational results.
  • Identify hidden review, correction, verification, and rework labor.
  • Build confidence ratings for each reconstructed field.
  • Flag missing, contradictory, duplicated, or unsupported records.
  • Develop standardized classifications for retain, remediate, replace, restructure, impair, or terminate.
  • Produce datasets and analytical outputs suitable for forensic accountants, restructuring advisors, counsel, boards, and investors.
b — Experience that helps

Where candidates may come from

Strong candidates may come from:

  • data analytics
  • forensic data analysis
  • banking or loan-file conversion
  • financial data reconciliation
  • merger integration
  • ERP conversion
  • regulatory remediation
  • data-quality management
  • master data management
  • internal audit analytics
  • procurement analytics
  • cloud FinOps
  • cost accounting
  • claims analytics
  • restructuring support
  • large-scale records normalization

Experience cleaning and reconciling poor-quality institutional data is more important than experience building polished dashboards.

c — Required skills

Required skills

  • SQL
  • Python, R, or equivalent analytical tooling
  • Data profiling
  • Data normalization
  • Entity resolution
  • Record linkage
  • Financial reconciliation
  • Cost allocation
  • Data lineage
  • Exception analysis
  • Missing-data analysis
  • Confidence scoring
  • Scenario analysis
  • Documentation of analytical assumptions
  • Ability to create reproducible analytical workflows
  • Ability to explain what the data can and cannot prove
d — Preferred qualifications

Preferred qualifications

  • Five or more years in data analytics, forensic analytics, financial analysis, audit analytics, cloud cost analysis, or enterprise data remediation
  • Experience reconciling multiple financial, procurement, operational, and technical systems
  • Experience with ERP, procurement, cloud billing, identity, ticketing, document-management, and data-warehouse records
  • Familiarity with AI licensing, token consumption, model APIs, cloud infrastructure, and enterprise software pricing
  • Familiarity with Power BI, Tableau, data notebooks, graph databases, or other investigative visualization tools
  • Data governance or data-quality credentials are useful but not required
e — Primary deliverables

Primary deliverables

  • AI asset and expenditure data model
  • Source-system inventory
  • Data dictionary
  • Normalized AI portfolio dataset
  • Vendor and contract reconciliation
  • Total expenditure reconstruction
  • Expected-versus-actual outcome analysis
  • Hidden labor and rework analysis
  • Evidence confidence scores
  • Portfolio classification model
  • Recovery-ready analytical package
APPLYP.03 — AI Data Reconstruction and Forensic Analytics ArchaeologistInclude a résumé and a short note on records you have had to reconstruct.