Security Governance, Risk & Compliance Program Lead

Solix•Parsippany, NJ

About The Position

The Security Governance, Risk & Compliance Program Lead will help lead and mature Solix’s cybersecurity Governance, Risk, and Compliance (GRC) program. Reporting to the Director of Infrastructure, Cybersecurity, and Service Desk, the role supports security governance, risk assessments, control management and testing, policy management, audit readiness, and remediation oversight. The Program Lead translates cybersecurity frameworks, regulatory obligations, contractual requirements, and client commitments into clear, sustainable control practices. The role works with control owners and stakeholders to assess control design and effectiveness, evaluate supporting evidence, identify gaps, and coordinate corrective actions. It requires practical experience in cybersecurity governance, IT risk, security controls, compliance, or technology audit, as well as strong organizational and project management skills to manage assessments, stakeholders, deadlines, dependencies, and remediation commitments. The successful candidate will work at the intersection of cybersecurity governance, security controls, technology risk, audit readiness, and process improvement. They must understand technical processes, evaluate control evidence, communicate risk clearly, and coordinate work across technical and non-technical teams.

Requirements

Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Information Systems, Risk Management, Audit, Compliance, Business Administration, or a related discipline, or equivalent practical experience.
Five or more years of experience in cybersecurity GRC, IT risk, security controls, technology compliance, IT audit, security assurance, or a related field.
Experience performing or supporting control assessments, including evaluating control design, implementation, or operating effectiveness.
Experience gathering, reviewing, and evaluating technical and procedural evidence against control, audit, or compliance requirements.
Working knowledge of one or more recognized security or control frameworks, including NIST CSF, NIST SP 800-53, ISO/IEC 27001, SOC 2, PCI DSS, HIPAA/HITECH, HITRUST, CIS Controls, or COBIT.
Familiarity with cybersecurity domains such as identity and access management, vulnerability management, asset management, incident response, logging and monitoring, data protection, change management, business continuity, third-party risk, or secure development.
Experience working with control owners, technical teams, business stakeholders, auditors, Legal, Compliance, or other cross-functional groups.
Strong analytical and documentation skills, including the ability to prepare control narratives, risk statements, testing summaries, corrective action plans, and leadership reports.
Ability to manage multiple concurrent workstreams, follow up on open items, identify blockers, and communicate risks and dependencies clearly.
Ability to lead through influence and constructively challenge insufficient evidence, unclear ownership, missed commitments, and control weaknesses.

Nice To Haves

Professional certifications such as CISA, CRISC, CISM, CISSP, CGEIT, CDPSE, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent security, risk, audit, or governance certifications.
Experience supporting SOC 1 or SOC 2 examinations, HITRUST certification, PCI DSS assessments, HIPAA/HITECH compliance, ISO 27001 certification, NIST-based programs, or client security assessments.
Experience maintaining or improving a control library, integrated control framework, risk register, policy inventory, audit program, or remediation process.
Experience with GRC platforms, audit evidence repositories, workflow systems, ticketing platforms, control monitoring tools, or reporting dashboards.
Experience with GRC automation, automated evidence collection, workflow design, structured data, scripting, SQL, APIs, or related technologies.
Project management experience or certifications such as PMP, CAPM, or PRINCE2.
Experience in a regulated, client contract-driven, healthcare-adjacent, government services, business process outsourcing, or technology services environment.
Familiarity with third-party technology risk and vendor assurance reviews.

Responsibilities

Maintain and continuously improve the cybersecurity control framework, including control descriptions, owners, mappings, evidence requirements, testing procedures, and control narratives.
Perform or coordinate control assessments, evaluating control design, implementation, and operating effectiveness.
Review technical and procedural evidence to determine whether it demonstrates control performance and meets audit or assessment requirements.
Maintain the cybersecurity risk register and coordinate risk assessments, treatment plans, risk acceptances, policy exceptions, and compensating controls.
Coordinate the development, review, approval, and maintenance of cybersecurity policies, standards, procedures, and supporting documentation.
Support internal and external audits, client assessments, certifications, and assurance activities, including evidence collection, quality review, and response coordination.
Track findings, risks, corrective action plans, remediation owners, due dates, dependencies, and completion evidence.
Work with technical and business control owners to resolve evidence gaps, clarify control expectations, and improve control quality.
Support frameworks and requirements including NIST CSF, NIST SP 800-53, SOC 1, SOC 2, HITRUST, HIPAA/HITECH, PCI DSS, ISO/IEC 27001, CIS Controls, and customer contractual obligations.
Coordinate responses to client security questionnaires and cybersecurity due diligence requests.
Develop GRC metrics and dashboards covering control performance, audit readiness, findings, risk treatment, remediation status, policy compliance, and exceptions.
Identify opportunities to standardize or automate GRC workflows, evidence collection, control monitoring, and reporting.
Organize GRC initiatives by maintaining work plans, milestones, action logs, governance calendars, and stakeholder communications.
Promote high-quality documentation, accountability, defensible control testing, and continuous improvement throughout the cybersecurity program.