Lead Security Analyst

Ovative Group•Minneapolis, MN

12d•$90,000 - $132,000•Hybrid

About The Position

Ovative Group is seeking a Security Analyst to join their Information Security team. This role is responsible for the operational aspects of the governance, risk, and compliance program, including client security questionnaires, vendor assessments, and SOC 2 operations. Additionally, the role will develop new capabilities in AI governance and enablement. The ideal candidate should be a strong writer, highly organized, comfortable interacting with both technical and non-technical individuals, and enthusiastic about facilitating the safe and rapid adoption of AI within the company.

Requirements

Two-year or four-year degree in information security, information technology, business, or related field; or 3+ years of equivalent experience
2–5 years of experience in a security analyst, GRC, IT audit, compliance, or similar role
Working knowledge of security and compliance frameworks such as SOC 2, NIST CSF, or ISO 27001
Experience responding to security questionnaires, conducting vendor assessments, or supporting audits
Familiarity with data privacy regulations (CCPA, GDPR, etc.)
Hands-on experience using generative AI tools, and a strong interest in AI governance and safe adoption
Excellent written communication — much of this work is turning technical reality into clear, accurate answers
Strong organization and attention to detail, with the ability to manage many parallel workstreams
Ability to work effectively with technical and non-technical stakeholders across the business

Nice To Haves

Certifications such as Security+, CISA, CRISC, or CIPP
Experience with compliance automation platforms (Vanta, Drata, or similar)
Familiarity with AI governance frameworks (NIST AI RMF, ISO/IEC 42001, OWASP GenAI Security)
Exposure to security operations tooling (SIEM, EDR) and alert triage
Experience with M365 and Google Workspace administration or security configuration
Basic scripting skills (Python or similar) for reporting and automation
Experience working with personal information or other regulated data

Responsibilities

Own client security questionnaires end to end; build and maintain a reusable answer library to make each response faster and more consistent
Conduct vendor security assessments for new vendors and renewals; maintain ongoing vendor risk tracking
Run SOC 2 compliance operations, including evidence collection, control monitoring, and audit support
Maintain the risk register: track remediation owners and progress, and prepare quarterly risk reviews
Drive the policy lifecycle: annual reviews, redline recommendations, and exception tracking
Support review of client contractual security obligations in partnership with our contracts administration team
Support data privacy compliance operations (CCPA, GDPR, etc.), including data inventory and mapping, subprocessor tracking, and data subject request support
Operate the AI tool and vendor intake process: triage requests, run security and risk reviews, and document decisions
Conduct AI risk assessments using our risk methodology — threat modeling, control analysis, and risk scenarios — and help mature it into a repeatable framework
Build and maintain our AI inventory of approved tools, agents, and connectors; monitor for unapproved AI use
Maintain AI usage policies and standards, and manage the exception process
Support access reviews for AI agents and connectors, including what data non-human identities can reach
Deliver secure-AI enablement: training, office hours, and onboarding users to approved tools
Track the evolving AI regulatory and framework landscape (EU AI Act, NIST AI RMF, OWASP GenAI Security) and the AI governance sections appearing in client questionnaires
Manage the security awareness training program, including content updates, completion tracking, and new-hire onboarding
Run phishing simulation campaigns, reporting, and follow-up coaching
Own security communications and the intake channel for employee security questions
Coordinate and execute periodic user access reviews and validate offboarding completion
Review third-party application and OAuth grants across M365 and Google environments
Build and maintain security metrics and dashboards covering operational trends, compliance posture, and training completion; support leadership reporting
Produce periodic threat intelligence digests for the team
Depending on experience and interest, support security alert triage, incident documentation, and tabletop exercise coordination
Support business continuity and disaster recovery plan maintenance and test coordination

Benefits

Base Salary
Annual Bonus
Access to all office spaces in MSP, NYC, and CHI
Frequent, paid travel to our Minneapolis headquarters for company events, team events, and in-person collaboration with teams
Generous paid vacation policy
401k match program
Top-notch health insurance options, inclusive of same sex partners
Family formation benefits including reimbursement options for fertility, pregnancy, and parenting needs
Monthly stipend for your mobile phone and data plan
Sabbatical program
Charitable giving via our time and a financial match program
Shenanigan’s Day