Security Control Assessor

About the role

Join EY's Information Security team as a Security Control Assessor, leading the design and execution of control testing and risk assessment plans across the firm’s technology landscape.

Key responsibilities

• Develop and execute control testing plans for first‑line and second‑line security controls, including self‑assessment questionnaires and process assessments.
• Manage and train junior professionals to support test plan execution and risk assessment activities.
• Collaborate with global stakeholders across multiple EY service lines to drive the Member Firm and Application Technology Risk Self‑Assessment Program.
• Identify gaps, recommend improvements, and assist control owners in implementing effective security controls.

Required profile

• 3+ years of experience in IT, information security, or risk management, with audit or technology control testing experience.
• Experience working in global, virtual teams and strong communication skills in English.
• Advanced degree in Computer Science, Information Security, or related field, or equivalent experience.

Required skills

• Knowledge of external control standards such as ISO 27001, NIST 800‑53, COBIT.
• Familiarity with regulatory requirements including GDPR and SOX.
• Proficiency with Microsoft Office and M365 tools (Word, Excel, PowerPoint, SharePoint, PowerApps, PowerBI).
• Experience using GRC platforms like RSA Archer.

What we offer

• Continuous learning and development opportunities.
• Flexible working arrangements and a global, diverse team environment.
• Comprehensive benefits supporting physical, emotional, financial, and social well‑being.