Assistant Manager, IT Risk and Controls Testing Analyst

Role overview

Control testing

• Support automated control testing, identify tool integration opportunities, and map source systems for continuous results.
• Conduct manual, effectiveness-based security control testing.
• Maintain the testing framework, control-to-standard mappings, technical test queries, policy checks, and pass/fail criteria.
• Test identity, endpoint, network, and infrastructure controls; collect, validate, and document evidence.
• Use risk management to assess control value, control gaps, and remediation priorities.

Remediation and reporting

• Validate evidence submitted by risk and control owners to confirm remediation closes identified gaps.
• Follow up on outstanding actions, track progress to closure, and escalate overdue remediation.
• Track and report control gaps, risks, and non-compliance and support remediation recommendations.
• Maintain ServiceNow or an equivalent platform for remediation tracking and control lifecycle workflows.
• Contribute to testing updates, KPIs, dashboards, leadership reports, templates, and standard methodologies.
• Stay informed about testing methods, regulatory developments, and industry practices.

Essential experience

• Experience in information security, IT risk management, internal audit, compliance, or controls testing.
• Experience testing compliance, auditing, or assessing controls against standards such as ISO 27001, NIST, CIS Controls, or SOC 2.
• Working knowledge of automated control testing tools such as Qualys, Tenable, Rapid7, or similar.
• Experience with GRC or ITSM tools such as ServiceNow, Archer, MetricStream, or similar.
• Knowledge of risk and compliance methods and cybersecurity fundamentals.

Preferred qualifications and experience

• Microsoft security tooling such as Defender for Endpoint, Intune, or Sentinel and/or KQL query writing is advantageous.
• Experience in a large, global, matrixed organisation is an advantage.
• A bachelor’s degree or equivalent in Information Systems, Computer Science, Cybersecurity, Engineering, or a related field is preferred.

Skills

• Strong analytical, problem-solving, and critical-thinking skills.
• Clear written and verbal communication, including explaining technical material to diverse stakeholders.
• Strong organisation, prioritisation, and collaboration across global teams and cultures.

Posting details