IT Risk & Controls Analyst

A financial services organization in Virginia is seeking an IT Risk & Controls Analyst to join their team in Vienna.

About the Opportunity:

• 
  

  Schedule: Monday to Friday

  
  


• 
  

  Hours: Standard business

  
  


• 
  

  Setting: Hybrid (3 days onsite)

  
  

Responsibilities:

• 
  

  Plan and scope IT and Information Security control assessments, including communications, risk and control matrices, scope documents, and supporting materials

  
  


• 
  

  Conduct walkthroughs with business partners to identify actual versus expected controls

  
  


• 
  

  Develop and execute testing strategies to evaluate control effectiveness

  
  


• 
  

  Document testing procedures, results, issues, and assessment conclusions

  
  


• 
  

  Prepare final assessment reports and present findings to leadership and other stakeholders

  
  

Qualifications:

• 
  

  Experience performing control testing, audit, risk assessments, or related functions

  
  


• 
  

  Experience with IT and/or Information Security risk assessments

  
  


• 
  

  Knowledge of financial services regulations, standards, and frameworks, including FFIEC, NIST, ISO, NCUA, and GLBA

  
  


• 
  

  Familiarity with NIST Cybersecurity Framework and 800 Series, ISO 27001/27002, SANS/CIS, and PCI DSS

  
  


• 
  

  Bachelor's degree in Business, Information Systems, or a related field, or equivalent work or military experience

  
  


• 
  

  Strong research, analytical, problem-solving, planning, and organizational skills

  
  


• 
  

  Strong written, verbal, interpersonal, and technical writing skills

  
  


• 
  

  Ability to clearly communicate assessment findings, conclusions, and recommendations to leadership

  
  


• 
  

  Experience working effectively with staff, management, business stakeholders, and third parties

  
  


• 
  

  Ability to build effective relationships through rapport, trust, diplomacy, and tact

  
  


• 
  

  Strong proficiency with word processing and spreadsheet applications

  
  

Desired Skills:

• 
  
  
  

  Information Security certification, such as CISSP, CISA, CCSP, or CRISC

  
  
  
  


• 
  

  Experience working within Audit, Enterprise Risk Management (ERM), or First Line of Defense functions

  
  


• 
  

  Experience working in an Agile environment