Lead Security Analyst

About Ovative Group:Ovative Group is an independent, full-funnel media, measurement, and creative firm. Leveraging our deep industry expertise, we help brands like Best Buy, Domino's, American Eagle, The Home Depot, Post, Disney, Tumi, Michael Kors, Boost Mobile, and UnitedHealth Group transform their media and measurement programs. The result? Profitable growth that speaks for itself.At Ovative, we don't just track data, we redefine success. How do we do it? Our proprietary MarTech platform, EMRge helps businesses transform marketing into a driver of sustainable growth. Powered by Enterprise Marketing Return (EMR), our differentiated approach to holistic media buying, planning, and measurement, EMRge is the first MarTech platform to measure businesses holistically. We're all about raising the bar every day, and it shows. Our work has been recognized by organizations like Digiday, Google, Inc. 5000, USA Today, and Search Engine Land.About the RoleOvative Group is seeking a Security Analyst to join our growing Information Security team. Reporting to the Head of Information Security and Privacy, this roleowns the operational core of our governance, risk, and compliance program — client security questionnaires, vendor assessments, and SOC 2 operations — and builds out new capabilities in AI governance and enablement. The ideal candidate is a strong writer, highly organized, comfortable engaging both technical and non-technical stakeholders, and genuinely excited about helping a company adopt AI quickly and safely.ResponsibilitiesGovernance, Risk, and ComplianceOwn client security questionnaires end to end; build and maintain a reusable answer library to make each response faster and more consistentConduct vendor security assessments for new vendors and renewals; maintain ongoing vendor risk trackingRun SOC 2 compliance operations, including evidence collection, control monitoring, and audit supportMaintain the risk register: track remediation owners and progress, and prepare quarterly risk reviewsDrive the policy lifecycle: annual reviews, redline recommendations, and exception trackingSupport review of client contractual security obligations in partnership with our contracts administration teamSupport data privacy compliance operations (CCPA, GDPR, etc.), including data inventory and mapping, subprocessor tracking, and data subject request supportAI Governance and EnablementOperate the AI tool and vendor intake process: triage requests, run security and risk reviews, and document decisionsConduct AI risk assessments using our risk methodology — threat modeling, control analysis, and risk scenarios — and help mature it into a repeatable frameworkBuild and maintain our AI inventory of approved tools, agents, and connectors; monitor for unapproved AI useMaintain AI usage policies and standards, and manage the exception processSupport access reviews for AI agents and connectors, including what data non-human identities can reachDeliver secure-AI enablement: training, office hours, and onboarding users to approved toolsTrack the evolving AI regulatory and framework landscape (EU AI Act, NIST AI RMF, OWASP GenAI Security) and the AI governance sections appearing in client questionnairesSecurity Awareness and TrainingManage the security awareness training program, including content updates, completion tracking, and new-hire onboardingRun phishing simulation campaigns, reporting, and follow-up coachingOwn security communications and the intake channel for employee security questionsIdentity and Access GovernanceCoordinate and execute periodic user access reviews and validate offboarding completionReview third-party application and OAuth grants across M365 and Google environmentsReporting and Security Operations SupportBuild and maintain security metrics and dashboards covering operational trends, compliance posture, and training completion; support leadership reportingProduce periodic threat intelligence digests for the teamDepending on experience and interest, support security alert triage, incident documentation, and tabletop exercise coordinationSupport business continuity and disaster recovery plan maintenance and test coordinationSkills and QualificationsTwo-year or four-year degree in information security, information technology, business, or related field; or 3+ years of equivalent experience2–5 years of experience in a security analyst, GRC, IT audit, compliance, or similar role title and level will be commensurate with experienceWorking knowledge of security and compliance frameworks such as SOC 2, NIST CSF, or ISO 27001Experience responding to security questionnaires, conducting vendor assessments, or supporting auditsFamiliarity with data privacy regulations (CCPA, GDPR, etc.)Hands-on experience using generative AI tools, and a strong interest in AI governance and safe adoptionExcellent written communication — much of this work is turning technical reality into clear, accurate answersStrong organization and attention to detail, with the ability to manage many parallel workstreamsAbility to work effectively with technical and non-technical stakeholders across the businessPreferred QualificationsCertifications such as Security+, CISA, CRISC, or CIPPExperience with compliance automation platforms (Vanta, Drata, or similar)Familiarity with AI governance frameworks (NIST AI RMF, ISO/IEC 42001, OWASP GenAI Security)Exposure to security operations tooling (SIEM, EDR) and alert triageExperience with M365 and Google Workspace administration or security configurationBasic scripting skills (Python or similar) for reporting and automationExperience working with personal information or other regulated dataPay TransparencyAt Ovative, we offer a transparent view into three core components of your totalcompensation package: Base Salary, Annual Bonus, and Benefits. The salary range for this position below is inclusive of an annual bonus. Actual offers are made with consideration for relevant experience and anticipated impact. Additional benefits information is provided below.For our senior security analyst positions, our compensation ranges from $90,000 to $132,000, which is inclusive of a 20% bonus.Benefits of Working at Ovative Group:We provide strong, competitive, holistic benefits that understand the importance of your life inside and out of work.  Culture: Culture matters and we’ve been recognized as a Top Workplace for ten years running because of it. We demand trust and transparency from each other. We believe in doing the hard and complicated work others put off. We’re open in communication and floor plan. We’re flat – our interns sit next to VPs, our analysts work closely with senior leaders, and our CEO interacts with every single person daily. Put together, these elements help foster an environment where smart people can support each other in performing to their highest potential.  Ovative is committed to fostering an inclusive environment where everyone can participate and thrive. We do not tolerate discrimination of any kind, including on the basis of race, sexual orientation, gender identity, or gender expression. Our policies reflect this commitment—for example, our medical leave benefits are inclusive of same-sex partners, ensuring equitable care and support for all families. Compensation and Insurance: We strive to hire and retain the best talent. Paying fair, competitive compensation, with a large bonus incentive, and phenomenal health insurance is an important part of this mix.  We’re rewarded fairly and when the company performs well, we all benefit.  Tangible amenities we enjoy: Access to all office spaces in MSP, NYC, and CHI  Frequent, paid travel to our Minneapolis headquarters for company events, team events, and in-person collaboration with teamsGenerous paid vacation policy  401k match program  Top-notch health insurance options, inclusive of same sex partners Family formation benefits including reimbursement options for fertility, pregnancy, and parenting needs Monthly stipend for your mobile phone and data plan  Sabbatical program  Charitable giving via our time and a financial match program  Shenanigan’s Day  Working at Ovative won’t be easy, but if you like getting your hands dirty, driving results, and being surrounded by the best talent, it’ll be the most rewarding job you’ll ever have. If you think you can make us better, we want to hear from you!  SummaryLocation: Minneapolis; ChicagoType: Full time