Security Controls Analyst

The IT Risk QA Senior Analyst will support the IT Risk & Governance team by translating established cybersecurity standards into net-new, testable security controls. This person will work directly with technical IT SMEs to understand processes, recommend and design appropriate controls, and independently test those controls for both design and operating effectiveness. This is a hands-on technical controls role, not an audit coordination or document collection position

• 5+ years of cybersecurity GRC, IT Risk, IT Audit, or security controls experience
• Strong experience designing and creating net-new cybersecurity controls
• Experience translating cybersecurity standards into clear, testable controls
• Hands-on experience with design effectiveness and operating effectiveness testing
• Ability to review technical processes, evidence, samples, exceptions, and control gaps
• Experience working directly with technical IT SMEs and control owners
• Experience independently driving controls from design through testing and completion
• Technical knowledge across IAM, cloud security, cryptography, network security, vulnerability management, and data protection
• Knowledge of NIST, FFIEC, CIS Controls, ISO 27001, or SOX ITGC
• Financial services or highly regulated industry experience
• CISA, CISSP, CISM, CRISC, Security+, or similar certification
• Experience with Archer or similar GRC platforms