Control Design & Modernization Specialist Position.

Control Assessment & Discovery • Review policies, standards, procedures, risk assessments, audit findings, regulatory requirements, and existing control inventories. • Assess current-state controls to identify gaps, overlaps, redundancies, and opportunities for improvement. • Evaluate existing control frameworks against industry best practices and regulatory expectations. Future-State Control Design • Design and document future-state controls that are risk-based, measurable, testable, and scalable. • Develop clear control objectives, control activities, ownership models, evidence requirements, and implementation guidance. • Rationalize and standardize controls across multiple ES&F functions to improve consistency and effectiveness. • Design controls with automation and Continuous Controls Monitoring (CCM) capabilities in mind. Stakeholder Engagement • Facilitate workshops and working sessions with security, technology, risk, compliance, audit, and business stakeholders. • Challenge legacy approaches and drive alignment on future-state control designs. • Build consensus across diverse stakeholder groups and ensure control designs meet business and regulatory expectations. GRC Modernization Support • Contribute to the development of enterprise control libraries, control standards, taxonomies, and framework mappings. • Support broader GRC modernization initiatives focused on improving control effectiveness, reducing complexity, and enabling scalable assurance. • Identify opportunities to leverage automation, analytics, AI, and modern GRC practices to enhance control maturity. Qualifications Required Qualifications • 8 years of experience in cybersecurity, risk management, governance, compliance, controls design, internal audit, or related disciplines. • Proven experience designing, enhancing, or transforming controls within financial services or other highly regulated industries. • Robust experience translating policies, standards, risks, audit findings, and regulatory requirements into effective control designs. • Deep understanding of control lifecycle management, including control design, implementation, testing, monitoring, remediation, and continuous improvement. • Demonstrated ability to lead workshops and influence senior stakeholders. • Robust analytical, documentation, and problem-solving skills. • Excellent written and verbal communication skills. Preferred Qualifications • Experience supporting large-scale GRC modernization, control transformation, or cybersecurity governance initiatives. • Experience designing controls for Continuous Controls Monitoring (CCM) and automated assurance capabilities. • Knowledge of AI Governance, AI Risk Management, and emerging AI-related regulatory requirements. • Experience developing control libraries, taxonomies, framework mappings, and enterprise control standards. Robust knowledge of: • NIST Cybersecurity Framework (CSF) • NIST 800-53 • ISO 27002 • CIS Controls • COBIT • Consulting, risk advisory, internal audit, or Big Four experience robustly preferred. • Professional certifications such as CISSP, CISM, CISA, CRISC, CIA, or CPA preferred.