Security Governance Compliance Analyst

DeWinter BH; Foster City (CA); Hybrid; USD 120,000 - 180,000; Part time

Job summary

DeWinter Group in Foster City, CA, is seeking a Security Governance Compliance Analyst to strengthen governance, risk, and compliance across a fast-paced environment. The role will lead security audits, perform risk assessments, and maintain documentation to ensure alignment with security policies and frameworks.

You will collaborate with IT, Product Security, and other teams to prioritize risks, develop remediation strategies, and shape effective control environments that support organizational

Qualifications

• 5+ years of experience conducting security control assessments, compliance assessments, or security audits.
• 5+ years working with information security standards and privacy laws (e.g., NIST 800-53, NIST CSF 2.0, ISO 27001, GDPR, CCPA, CPRA).
• Strong knowledge of governance, risk, and compliance frameworks and tools.
• Experience planning and leading organization-wide security audits.
• Ability to coordinate internal and external audits with IT, Product Security, and other teams.

Responsibilities

• Lead security audits and assessments across the organization.
• Conduct risk assessments and support remediation strategies.
• Maintain and review compliance documentation and evidence.
• Coordinate with IT, Product Security, and other teams for audit readiness.
• Develop and maintain security control frameworks and remediation plans.

Skills

Security governance

Compliance assessments

Security audits

Risk assessment

NIST 800-53

ISO 27001

GDPR/CCPA/CPRA

Audit coordination

Policy development

Cross-functional collaboration

Education

Bachelor's degree in CS/IS/Business

Professional security certification (CISA/CISM/CRISC/CISSP)

Equivalent relevant experience

Job description

Security Governance Compliance Analyst

Overview

Support the organization’s information security program by strengthening governance, risk management, and compliance practices across a dynamic, fast-paced environment. The Security Governance Compliance Analyst will lead security audits, conduct risk assessments, maintain compliance documentation, and partner with teams across the organization to ensure alignment with established security policies, standards, and frameworks.

This role offers the opportunity to help shape effective control environments, identify and prioritize security risks, and develop remediation strategies that support organizational resilience and measurable security outcomes.

Required Skills

• 5+ years of experience conducting security control assessments, compliance assessments, or security audits.
• 5+ years of experience working with information security standards and privacy laws, such as:
• NIST 800-53
• NIST Cybersecurity Framework 2.0
• ISO 27001
• GDPR
• CCPA
• CPRA
• Strong knowledge of governance, risk, and compliance frameworks and tools.
• Proficiency with risk assessment methodologies and tools.
• Experience planning and leading organization-wide security audits.
• Ability to coordinate internal and external audits with IT, Product Security, and other teams.
• Experience preparing, reviewing, and maintaining compliance documentation.
• Ability to conduct risk exposure and comparative risk assessments.
• Strong understanding of risk prioritization based on potential impact and likelihood.
• Experience developing and implementing remediation plans.
• Ability to develop and maintain effective security control frameworks.
• Familiarity with security management tools, including vulnerability scanners, file integrity monitoring, and configuration monitoring.
• Familiarity with perimeter security technologies, including routers, firewalls, web proxies, and intrusion prevention systems.
• Comfortable working with artificial intelligence, machine learning, and large language models.
• Excellent analytical and critical-thinking skills.
• Strong written and verbal communication skills.
• Ability to collaborate effectively with multiple departments in a changing environment.

Nice-to-Have Skills

• Experience in automotive, aerospace, industrial control systems, SCADA, or other high-assurance environments.
• Experience identifying gaps in platform security and compliance processes.
• Experience evaluating security solutions and their potential business and security impact.
• Professional certification such as CISA, CISM, CRISC, or CISSP.
• 8+ years of relevant experience for candidates considered at the L5 level.

Preferred Education and Experience

• Bachelor’s degree in Computer Science, Information Systems, Business, or a related field.
• Equivalent relevant professional experience may be considered.
• At least 5 years of relevant security governance, compliance, audit, or risk assessment experience.

Other Requirements

• This is a hybrid position based in Foster City, California.
• W-2 employment only.
• Six-month engagement.