Security Governance, Risk & Compliance Program Lead

Solix Inc•Parsippany, NJ

1d•$135,000 - $145,000

About The Position

The Security Governance, Risk & Compliance Program Lead will help lead and mature Solix’s cybersecurity Governance, Risk, and Compliance (GRC) program. Reporting to the Director of Infrastructure, Cybersecurity, and Service Desk, the role supports security governance, risk assessments, control management and testing, policy management, audit readiness, and remediation oversight. The Program Lead translates cybersecurity frameworks, regulatory obligations, contractual requirements, and client commitments into clear, sustainable control practices. The role partners with control owners and stakeholders to assess control design and effectiveness, evaluate supporting evidence, identify gaps, and coordinate corrective actions. Success requires practical experience in cybersecurity governance, IT risk, security controls, compliance, or technology audit, together with strong organizational and project management skills for managing assessments, stakeholders, deadlines, dependencies, and remediation commitments. Solix describes itself as a national provider of consulting and business process solutions, focused on complex program management, eligibility determination, customer care, and state and federal funding recovery. The company highlights opportunities to contribute to a growing cybersecurity program, collaborate with a skilled technical team, develop professionally, and support modern technologies and business-critical platforms.

Requirements

Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Information Systems, Risk Management, Audit, Compliance, Business Administration, or a related discipline, or equivalent practical experience.
Five or more years of experience in cybersecurity GRC, IT risk, security controls, technology compliance, IT audit, security assurance, or a related field.
Experience performing or supporting control assessments, including evaluating control design, implementation, or operating effectiveness.
Experience gathering, reviewing, and evaluating technical and procedural evidence against control, audit, or compliance requirements.
Working knowledge of one or more recognized security or control frameworks, such as NIST CSF, NIST SP 800-53, ISO/IEC 27001, SOC 2, PCI DSS, HIPAA/HITECH, HITRUST, CIS Controls, or COBIT.
Familiarity with cybersecurity domains such as identity and access management, vulnerability management, asset management, incident response, logging and monitoring, data protection, change management, business continuity, third-party risk, or secure development.
Experience working with control owners, technical teams, business stakeholders, auditors, Legal, Compliance, or other cross-functional groups.
Strong analytical and documentation skills, including the ability to prepare control narratives, risk statements, testing summaries, corrective action plans, and leadership reports.
Ability to manage multiple concurrent workstreams, follow up on open items, identify blockers, and communicate risks and dependencies clearly.
Ability to lead through influence and constructively challenge insufficient evidence, unclear ownership, missed commitments, and control weaknesses.

Nice To Haves

Certifications such as CISA, CRISC, CISM, CISSP, CGEIT, CDPSE, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent security, risk, audit, or governance certifications.
Experience supporting SOC 1 or SOC 2 examinations, HITRUST certification, PCI DSS assessments, HIPAA/HITECH compliance, ISO 27001 certification, NIST-based programs, or client security assessments.
Experience maintaining or improving a control library, integrated control framework, risk register, policy inventory, audit program, or remediation process.
Experience with GRC platforms, audit evidence repositories, workflow systems, ticketing platforms, control monitoring tools, or reporting dashboards.
Experience with GRC automation, automated evidence collection, workflow design, structured data, scripting, SQL, APIs, or related technologies.
Project management experience or certifications such as PMP, CAPM, or PRINCE2.
Experience in a regulated, client contract-driven, healthcare-adjacent, government services, business process outsourcing, or technology services environment.
Familiarity with third-party technology risk and vendor assurance reviews.

Responsibilities

Maintain and continuously improve the cybersecurity control framework, including control descriptions, owners, mappings, evidence requirements, testing procedures, and narratives.
Perform or coordinate assessments of control design, implementation, and operating effectiveness.
Review technical and procedural evidence to determine whether it demonstrates control performance and satisfies audit or assessment requirements.
Maintain the cybersecurity risk register and coordinate risk assessments, treatment plans, risk acceptances, policy exceptions, and compensating controls.
Coordinate development, review, approval, and maintenance of cybersecurity policies, standards, procedures, and supporting documentation.
Support internal and external audits, client assessments, certifications, and assurance activities, including evidence collection, quality review, and response coordination.
Track findings, risks, corrective action plans, remediation owners, due dates, dependencies, and completion evidence.
Work with technical and business control owners to resolve evidence gaps, clarify control expectations, and improve control quality.
Support security frameworks and requirements, including NIST CSF, NIST SP 800-53, SOC 1, SOC 2, HITRUST, HIPAA/HITECH, PCI DSS, ISO/IEC 27001, CIS Controls, and customer contractual obligations.
Coordinate responses to client security questionnaires and cybersecurity due diligence requests.
Develop GRC metrics and dashboards covering control performance, audit readiness, findings, risk treatment, remediation status, policy compliance, and exceptions.
Identify opportunities to standardize or automate GRC workflows, evidence collection, control monitoring, and reporting.
Organize GRC initiatives by maintaining work plans, milestones, action logs, governance calendars, and stakeholder communications.
Promote high-quality documentation, accountability, defensible control testing, and continuous improvement throughout the cybersecurity program.