IT Security Controls Analyst

An established financial services organization in Vienna, VA is seeking an IT Security Controls Analyst to support the assessment and testing of IT and information security controls, with a focus on evaluating effectiveness, identifying risks, and documenting findings., Plan and scope IT and information security control assessments, including risk and control matrices and supporting documentation * Conduct walkthroughs with business partners to evaluate control design and operating effectiveness * Develop and execute testing procedures to assess controls and review supporting evidence * Document test results, control deficiencies, risks, and remediation recommendations * Prepare assessment reports and collaborate with internal audit, risk, security, and business stakeholders

1+ years of experience in IT controls testing, IT audit, IT risk management, information security assessments, or a related field * Bachelor’s degree in Business, Information Systems, or a related field, or equivalent professional or military experience * Experience evaluating IT and information security controls and conducting risk assessments * Working knowledge of security frameworks and standards such as NIST, FFIEC, ISO 27001/27002, CIS Controls, or PCI DSS * Proficiency with Microsoft Office applications, including Word and Excel * Ability to document testing procedures, analyze evidence, and communicate findings clearly * Strong analytical, research, problem-solving, and organizational skills * Excellent written and verbal communication skills, including technical writing and reporting * Ability to collaborate effectively with technical teams, business stakeholders, and management

Desired Skills: * Professional certifications such as CISA, CISSP, CRISC, CCSP, or equivalent * Experience performing asset-based testing or IT security controls assurance assessments * Experience in financial services or another highly regulated industry * Familiarity with NCUA, GLBA, NIST Cybersecurity Framework, NIST 800 Series, or other financial services security requirements * Knowledge of IIA standards and audit documentation requirements * Experience working in Agile environments * Familiarity with Bank Secrecy Act compliance requirements