Security Assurance Specialist (Ref: 198074)

Role overview

Assurance planning and testing

• Develop risk-based assurance plans for priority controls, remediation commitments, and readiness milestones.
• Review control design against policies, standards, risk expectations, and assurance frameworks.
• Test implementation and operating effectiveness where sufficient operating history is available.
• Examine evidence for accuracy, completeness, relevance, ownership, and control alignment.
• Maintain auditable working papers linking risks, controls, actions, evidence, and conclusions.
• Challenge weak submissions and specify additional evidence required.
• Issue concise findings on control gaps, evidence weaknesses, and residual risk.
• Reassess corrected controls to verify underlying weaknesses are addressed.

Governance and coordination

• Engage action owners constructively while maintaining assurance independence and objectivity.
• Escalate material, recurring, or systemic deficiencies through governance channels.
• Contribute to consolidated security reporting, risk dashboards, and management updates.
• Coordinate with GRC, security, technology, and business teams to establish sustainable ongoing assurance.

Control areas and readiness

• Assess identity and access management, privileged access, segregation of duties, vulnerability management, network security, and operational resilience.
• Review supplier security, data protection, security operations, and technology change safeguards.
• Support readiness assessments during hypercare, transformation releases, and significant implementation phases.
• Apply ISO/IEC 27001:2022, NIST CSF, and internal information security requirements.

Required qualifications

• Several years in information security assurance, technology risk, IT audit, internal controls, or GRC.
• Ability to assess control design, implementation, and operation, using risk-based assurance and control-testing methods.
• Practical understanding of ISO/IEC 27001 and NIST Cybersecurity Framework concepts.
• Experience assessing technical and governance evidence and reaching balanced, supported conclusions.
• Knowledge of the listed security control domains and ability to work across technical, audit, risk, and senior stakeholder groups.
• Strong analytical skills, professional judgement, written communication, independence, organization, and recordkeeping.

Preferred qualifications

• ERP, SAP, or complex technology transformation experience is advantageous.
• Experience in retail, distribution, marketing services, or other multi-site customer-facing environments is beneficial.
• CISA, CISM, CISSP, CRISC, ISO/IEC 27001 Lead Auditor, or Lead Implementer certification is preferred.