Security Control Assessor (Control & Risk Assessment Specialist)

About the role

EY's Information Security function protects data and information systems, blending risk strategy, digital identity, cyber defense, application security and technology solutions. Within the Technology Assurance, Risk and Policy (TARP) function, the Control & Risk Assessment team designs control testing and risk assessment methodology to measure and quantify compliance with policies and control objectives. This specialist leads and executes control testing plans, including self-assessment questionnaires, control testing and process assessments, and manages and trains junior professionals.

Key responsibilities

• Lead and execute control testing plans for Information Security controls, using 1st and 2nd line testing best practices, and assess whether they support desired business outcomes.
• Manage and train a team of junior professionals to help run the test plans.
• Work with control owners to design and implement controls in the IT environment, balancing security needs with business impact.
• Support risk assessment methodology development, identify gaps and improvements, and collaborate with Information Security, Client and Enterprise Technology, Data Protection, Risk Management, Internal Audit and other stakeholders, including Member Firm and Application Technology Risk Self-Assessment.
• Contribute to a long-term vision for the Control & Risk Assessment Program and stay informed of regulatory requirements, audit standards and industry trends.

Required profile

• 3+ years of experience in Information Technology, Information Security and/or Risk Management.
• Audit experience or a demonstrated ability to design and test technology controls.
• Experience working on global and virtual teams.
• Advanced degree in Computer Science, Information Security or a related field; equivalent work experience considered on a case-by-case basis.
• Preferred certifications: CRISC, CISSP, CISM, CISA, CIA, GIAC, CIPP, CIPT.
• Flexibility to work outside normal business hours for stakeholders in different time zones.

Required skills

• Ideally: ISO 27001, NIST 800-53, COBIT, GDPR and SOX knowledge.
• Microsoft Office and M365 (Word, Excel, PowerPoint, SharePoint, PowerApps, PowerBI).
• Experience with RSA Archer or other GRC tools.
• Strong communication, management and mentoring skills, and ability to lead cross-cultural teams.

What we offer

• A globally diverse team with flexible working.
• Benefits focused on physical, emotional, financial and social well-being, tailored to each country.
• Continuous learning, coaching and leadership development.