Security Governance, Risk & Compliance Program Lead

Security Governance, Risk & Compliance Program Lead Department: IT Administrative About Solix Solix is a leading national provider of consulting and business process solutions with expertise in complex program management, eligibility determination, customer care, and state and federal funding recovery. Our team is driven by our mission to connect people to essential programs and services.

We consult with our clients to develop optimal solutions, engage with our clients and their stakeholders to achieve mutually beneficial outcomes, and empower our clients and the people we collectively serve.

Position Summary

The Security Governance, Risk & Compliance Program Lead will help lead and mature the organization's cybersecurity Governance, Risk, and Compliance (GRC) program. Reporting to the Director of Infrastructure, Cybersecurity, and Service Desk, this individual will support security governance, risk assessments, control management and testing, policy management, audit readiness, and remediation oversight.

This role will translate cybersecurity frameworks, regulatory obligations, contractual requirements, and client commitments into clear and sustainable control practices. The Program Lead will work closely with control owners and stakeholders to assess control design and effectiveness, evaluate supporting evidence, identify gaps, and coordinate corrective actions.

The ideal candidate will bring practical experience in cybersecurity governance, IT risk, security controls, compliance, or technology audit, along with strong organizational and project management skills to successfully manage assessments, stakeholders, deadlines, dependencies, and remediation commitments.

Essential Duties

& Responsibilities Maintain and continuously improve the cybersecurity control framework, including control descriptions, owners, mappings, evidence requirements, testing procedures, and control narratives. Perform or coordinate control assessments, including evaluations of control design, implementation, and operating effectiveness.

Review technical and procedural evidence to determine whether it adequately demonstrates control performance and meets audit or assessment requirements. Maintain the cybersecurity risk register and coordinate risk assessments, treatment plans, risk acceptances, policy exceptions, and compensating controls. Coordinate the development, review, approval, and maintenance of cybersecurity policies, standards, procedures, and supporting documentation.

Support internal and external audits, client assessments, certifications, and assurance activities, including evidence collection, quality review, and response coordination. Track findings, risks, corrective action plans, remediation owners, due dates, dependencies, and completion evidence. Work with technical and business control owners to resolve evidence gaps, clarify control expectations, and improve control quality.

Support frameworks and requirements such as NIST CSF, NIST SP 800-53, SOC 1, SOC 2, HITRUST, HIPAA/HITECH, PCI DSS, ISO/IEC 27001, CIS Controls, and customer contractual obligations. Coordinate responses to client security questionnaires and cybersecurity due diligence requests. Develop GRC metrics and dashboards covering control performance, audit readiness, findings, risk treatment, remediation status, policy compliance, and exceptions.

Identify opportunities to standardize or automate GRC workflows, evidence collection, control monitoring, and reporting. Organize GRC initiatives by maintaining work plans, milestones, action logs, governance calendars, and stakeholder communications. Promote high-quality documentation, accountability, defensible control testing, and continuous improvement throughout the cybersecurity program.

Qualifications

The successful candidate will be comfortable working at the intersection of cybersecurity governance, security controls, technology risk, audit readiness, and process improvement. This position requires the ability to understand technical processes, evaluate control evidence, communicate risk clearly, and coordinate work across technical and non-technical teams.

Required Qualifications Bachelor's degree in Cybersecurity, Information Security, Information Technology, Information Systems, Risk Management, Audit, Compliance, Business Administration, or a related discipline, or equivalent practical experience. Five (5) or more years of experience in cybersecurity GRC, IT risk, security controls, technology compliance, IT audit, security assurance, or a related field.

Experience performing or supporting control assessments, including evaluating control design, implementation, or operating effectiveness. Experience gathering, reviewing, and evaluating technical and procedural evidence against control, audit, or compliance requirements. Working knowledge of one or more recognized security or control frameworks, including NIST CSF, NIST SP 800-53, ISO/IEC 27001, SOC 2, PCI DSS, HIPAA/HITECH, HITRUST, CIS Controls, or COBIT.

Familiarity with cybersecurity domains such as identity and access management, vulnerability management, asset management, incident response, logging and monitoring, data protection, change management, business continuity, third-party risk, or secure development. Experience working with control owners, technical teams, business stakeholders, auditors, Legal, Compliance, or other cross-functional groups.

Strong analytical and documentation skills, including the ability to prepare control narratives, risk statements, testing summaries, corrective action plans, and leadership reports. Ability to manage multiple concurrent workstreams, follow up on open items, identify blockers, and communicate risks and dependencies clearly.

Ability to lead through influence and constructively challenge insufficient evidence, unclear ownership, missed commitments, and control weaknesses.

Preferred Qualifications

Professional certifications such as CISA, CRISC, CISM, CISSP, CGEIT, CDPSE, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent security, risk, audit, or governance certifications. Experience supporting SOC 1 or SOC 2 examinations, HITRUST certification, PCI DSS assessments, HIPAA/HITECH compliance, ISO 27001 certification, NIST-based programs, or client security assessments.

Experience maintaining or improving a control library, integrated control framework, risk register, policy inventory, audit program, or remediation process. Experience with GRC platforms, audit evidence repositories, workflow systems, ticketing platforms, control monitoring tools, or reporting dashboards. Experience with GRC automation, automated evidence collection, workflow design, structured data, scripting, SQL, APIs, or related technologies.

Project management experience or certifications such as PMP, CAPM, or PRINCE2. Experience in a regulated, client contract-driven, healthcare-adjacent, government services, business process outsourcing, or technology services environment. Familiarity with third-party technology risk and vendor assurance reviews. Why Join Solix?

Be part of a growing cybersecurity program with significant opportunity for impact. Work alongside a collaborative and highly skilled technical team. Develop professionally with opportunities to advance. Support modern technologies and business-critical platforms in a dynamic and evolving environment. For more information about personal rights under Equal Employment Opportunity, visit: EEOC Poster , EEOC GINA Supplement , and OFCCP EEOC Supplement .

Solix, Inc. is an Equal Opportunity Employer – M/F/Veterans/Disabled and other protected categories.