Security & AI Governance Analyst

Ovative Group; Chicago (IL); On-site; USD 90,000 - 132,000; Full time

Benefits offered by this job

Office access to multiple offices

Travel to Minneapolis HQ for events

Generous vacation

401k match

Health insurance

Family formation benefits

Phone data stipend

Sabbatical program

Charitable giving

Shenanigan’s Day

Job summary

Ovative Group is seeking a Security Analyst to join our Information Security team. You will own the governance, risk, and compliance program, handling client security questionnaires, vendor assessments, and SOC 2 operations, while building capabilities in AI governance and enablement.

The ideal candidate is a strong writer, highly organized, and able to engage both technical and non-technical stakeholders. Experience with AI risk assessments and data privacy regulations is preferred.

Qualifications

• Experience answering security questionnaires and vendor assessments.
• Familiarity with data privacy regulations (CCPA, GDPR).
• Hands-on experience with generative AI tools and safe adoption.
• Excellent written communication.
• Ability to work with technical and non-technical stakeholders.

Responsibilities

• Own client security questionnaires end to end; build and maintain a reusable answer library.
• Conduct vendor security assessments for new vendors and renewals; maintain ongoing vendor risk tracking.
• Run SOC 2 compliance operations, including evidence collection, control monitoring, and audit support.
• Maintain the risk register: track remediation owners and progress, and prepare quarterly risk reviews.
• Drive the policy lifecycle: annual reviews, redline recommendations, and exception tracking.
• Support data privacy compliance operations (CCPA, GDPR), including data inventory and mapping, subprocessor tracking, and data subject request support.
• Operate the AI tool and vendor intake process: triage requests, run security and risk reviews, and document decisions.
• Conduct AI risk assessments using risk methodology and mature into a repeatable framework.
• Build and maintain our AI inventory of approved tools; monitor for unapproved AI use.
• Maintain AI usage policies and standards, and manage the exception process.
• Support access reviews for AI agents and connectors, including data access scopes.
• Deliver secure-AI enablement: training, office hours, onboarding users to approved tools.
• Track evolving AI regulatory landscape and AI governance in client questionnaires.
• Manage security awareness training program, phishing simulations, and security communications.
• Coordinate user access reviews and offboarding; review third-party OAuth grants across M365 and Google.
• Build security metrics dashboards; support leadership reporting.

Skills

Written communication

Organization

Stakeholder engagement

Attention to detail

AI governance

Security awareness

Problem solving

Education

InfoSec/IT/Business degree or 3+ years equivalent

Tools

SOC 2

NIST CSF

ISO 27001

Vanta/Drata

M365 security

Job description

Ovative Group is seeking a Security Analyst to join our Information Security team. You will own the governance, risk, and compliance program, handling client security questionnaires, vendor assessments, and SOC 2 operations, while building capabilities in AI governance and enablement.

The ideal candidate is a strong writer, highly organized, and able to engage both technical and non-technical stakeholders. Experience with AI risk assessments and data privacy regulations is preferred.