Senior IT Risk & Cybersecurity Controls Analyst

Job Description

Job Description

SYSTEMTEC is seeking a Senior IT Risk & Cybersecurity Controls Analyst for a remote opportunity for candidates working EST hours. Candidate will support a financial services organization in strengthening its IT risk and cybersecurity control environment by translating security standards and regulatory requirements into documented, measurable, and testable controls. The role will focus on control development, effectiveness testing, PCI DSS compliance support, and remediation validation to improve risk management and audit readiness.

Required Qualifications of the Senior IT Risk & Cybersecurity Controls Analyst:

• Applicants must be authorized to work for any employer in the U.S. We are unable to provide sponsorship or work with Third-Party agencies.
• Minimum of 5 years of experience in cybersecurity GRC, IT risk management, technology audit, control design, control testing, or regulatory compliance.
• Demonstrated experience translating security policies, standards, and regulatory requirements into traceable controls, testing procedures, and supporting documentation.
• Hands-on experience assessing control design and operating effectiveness, evaluating evidence, developing sampling approaches, documenting exceptions, and preparing audit-ready workpapers.
• Experience reviewing remediation evidence, validating corrective actions, assessing root causes, and determining whether issue closure criteria have been met.
• Working knowledge of PCI DSS requirements and experience mapping requirements to controls, evidence, ownership, and remediation activities.
• Experience using RSA Archer or a comparable governance, risk, and compliance (GRC) platform to maintain control records and assessment documentation.
• Knowledge of cybersecurity and control frameworks such as NIST CSF, NIST SP 800-53, CIS Controls, ISO 27001, FFIEC guidance, or SOX ITGCs.
• Understanding of core cybersecurity domains, including identity and access management, cloud security, vulnerability management, logging and monitoring, network security, data protection, and incident response.
• Strong analytical, technical writing, stakeholder communication, and documentation skills, with advanced proficiency in Microsoft Excel and Word.

Preferred Skills/Experience of the Senior IT Risk & Cybersecurity Controls Analyst:

• Experience working in banking, financial services, or another highly regulated industry.
• Relevant certifications such as CISA, CISSP, CISM, CRISC, CGEIT, or Security+.
• Experience supporting PCI DSS readiness assessments, audits, self-assessments, or Qualified Security Assessor (QSA) activities.
• Familiarity with enterprise control libraries, control rationalization, management control monitoring, and issue management processes.

Responsibilities of the Senior IT Risk & Cybersecurity Controls Analyst:

• Analyze information security standards and regulatory requirements, maintaining traceable mappings between requirements, risks, existing controls, and supporting evidence.
• Evaluate the existing control inventory to identify gaps, overlaps, redundancies, and opportunities to enhance or reuse controls before recommending new ones.
• Draft and refine control statements, documenting ownership, execution frequency, evidence requirements, associated risks, control characteristics, and testing procedures.
• Execute control walkthroughs and design and operating effectiveness testing; assess evidence quality, population completeness, sampling, exceptions, and results.
• Validate remediation efforts by reviewing supporting evidence, confirming corrective actions address identified risks and root causes, and documenting issue-closure recommendations.
• Support PCI DSS compliance activities, facilitate discussions with control owners and technical stakeholders, maintain GRC documentation, and deliver clear, accurate, audit-ready work products.

Work Location: Remote. EST hours.

Compensation / Benefits:
Full-Time Employment with SYSTEMTEC means competitive compensation, access to health, dental, disability, and life coverage, and 401(k) with match.

***Please note:  SYSTEMTEC is not set up to employ workers in the states of California, New York, and New Jersey .***