> Markdown version of [/jobs/ext/4323440-grc-cybersecurity-controls-analyst](https://www.wearedevelopers.com/jobs/ext/4323440-grc-cybersecurity-controls-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Cybersecurity Controls Analyst - **Company:** Tiktok Usds - **Location:** New York, NY, United States - **Experience:** Experienced - **Salary:** $98,800.0 - $196,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Cyber Security, Customer Data Management, Data Security, Disaster Recovery, Identity and Access Management, PCI Data Security Standards, Systems Development Life Cycle, SQL Databases, Software Vulnerability Management, Workflow Management Systems, Data Logging, Scripting, National Institute of Standards and Technology Cybersecurity Framework, Information Technology, Data Analytics - **Published:** October 27, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=4e30c7f86435d34d ## About the Role Minium Qualifications - Bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, Compliance, Engineering, Data Analytics, or a related discipline, or equivalent practical experience. - 3+ years of experience in GRC, IT risk, security controls, audit readiness, control testing, compliance, security assurance, or a related field. - Experience supporting control testing, compliance, audit readiness, or risk management in a financial services, fintech, payments, banking, or similarly regulated environment. Working knowledge of cybersecurity control testing for standards and frameworks such as ISO 27001, PCI-DSS, SOC 2, NIST CSF, or equivalent. - Familiarity with financial services regulatory obligations, including PCI-DSS, Money Transmitter License (MTL) requirements, payments compliance, consumer protection, safeguarding, transaction monitoring, or related controls. Ability to evaluate whether technical and operational evidence demonstrates compliance with control intent, regulatory expectations, and audit requirements - Experience gathering, reviewing, and assessing technical control evidence from stakeholders, systems, tools, dashboards, or documentation repositories. Familiarity with security domains such as Identity and Access Management, Vulnerability Management, Incident Management, Asset Management, Logging and Monitoring, Data Security, SDLC, Third-Party Risk Management, Business Continuity / Disaster Recovery, or Privacy. - Strong writing and documentation skills, with the ability to create clear control narratives, evidence and testing summaries, and status updates. Strong analytical skills and ability to assess whether evidence meets the intent of a control, requirement, or audit request. - Experience working with control owners, technical teams, auditors, legal, privacy, compliance, or cross-functional stakeholders. Ability to manage multiple workstreams, follow up on open items, identify blockers, and communicate risks clearly and demonstrated teamwork and collaboration skills, especially in fast-moving, cross-functional environments. Preferred Qualifications - Professional certification such as CISA, CISSP, CISM, CRISC, CDPSE, ISO 27001 Lead Auditor / Lead Implementer, or equivalent. - Direct experience supporting PCI-DSS and/or MTL audits, exams, licensing obligations, or financial services compliance programs - Experience supporting external audits, security certifications, or regulatory assessments such as SOC 2, ISO 27001, NIST CSF, or national security / data protection obligations. - Experience testing controls related to payments, funds movement, customer data protection, access management, transaction monitoring, incident response, vendor risk, business continuity, or data security in a regulated financial services environment. - Experience with GRC automation, control monitoring, evidence automation, dash boarding, workflow design, or data-driven control testing. - Experience working with legal, compliance, risk, audit, engineering, security, infrastructure, product, or data teams to translate technical processes into control evidence and audit-ready narratives. - Familiarity with automation, scripting, SQL, APIs, or data workflows used to improve GRC operations. ## Description About the Team TikTok is seeking a GRC Cybersecurity Controls Analyst to join the TikTok USDS Joint Venture (JV) GRC Controls & Certifications team. This role will support the operation, testing, and continuous improvement of the controls framework with a focus on cybersecurity, financial services, and regulated payments-related obligations, including Money Transmitter License (MTL)/PCI-DSS control expectations where applicable. This role will help drive audit readiness across key security, compliance, privacy, and regulatory obligations. About the Role The candidate will work closely with control owners, product teams, security teams, privacy, legal, internal audit, external auditors, and GRC leadership to evaluate control design, implementation, and operating effectiveness. The role will support control testing, evidence review, audit response coordination, control narrative development, and issue identification across cybersecurity, financial services, and regulatory frameworks such as ISO 27001, SOC 2, NIST CSF, PCI-DSS, Money Transmitter License (MTL) obligations, and other applicable security, compliance, privacy, and payments related assessment activities. The candidate will also help mature the team's approach to GRC automation and engineering. This includes improving how controls are mapped, tested, monitored, and reported through tooling, dashboards, structured data, workflow automation, evidence recommendations, and scalable testing. The ideal candidate is comfortable working at the intersection of GRC, security controls, audit readiness, and process automation. Responsibilities - Support the maintenance and continuous improvement of the controls framework, including control descriptions, mappings, owners, evidence expectations, testing procedures, and control narratives. - Execute internal and external cybersecurity controls testing across frameworks such as ISO 27001, PCI-DSS, SOC 2, NIST CSF, and related internal control frameworks, including assessment of control design, operating effectiveness, evidence sufficiency, and remediation tracking. - Support testing and documentation of controls relevant to financial services and regulated payments activities, including PCI-DSS and MTL-related obligations, compliance evidence, control mappings, and audit-readiness activities. - Map controls across cybersecurity, financial services, and regulatory requirements to reduce duplication, identify coverage gaps, and maintain a defensible integrated control framework. - Review evidence submitted by control owners and product teams to determine whether it sufficiently demonstrates control performance and meets audit or assessment expectations. - Coordinate with control owners, evidence owners, product teams, and GRC stakeholders to resolve evidence gaps, clarify control intent, and improve testing quality. - Support GRC automation initiatives by helping define requirements for workflow automation, control monitoring, and scalable control testing processes. - Work with technical and engineering teams to understand security tools, data sources, system-generated evidence, and opportunities to automate or improve control validation. - Contribute to a culture of high-quality documentation, defensible controls testing, and continuous improvement across the Controls & Certifications function.