Senior Cybersecurity CCM Business Analyst / Implementation Lead

The successful candidate must have prior hands-on experience designing, building or implementing a CCM solution and be able to apply proven delivery approaches and practical lessons learned from day one.

The contractor will work across cybersecurity control owners, engineering teams, data providers and risk stakeholders to identify controls suitable for automation, translate control objectives into exercutable monitoring routinesa, validate outputs, and drive end-to-end discussions through successful production go-live and operational adoption.

1. Identify and Prioritize CCM Use Cases

Partner with ES&F control owners and subject-matter experts to identify cybersecurity controls suitable for continuous monitoring and automation.

• Assess candidate controls based on risk significance, control maturity, repeatability, data availability, monitoring feasibility and expected assurance value.
• Facilitate structured discussions to define the control objective, monitoring intent, desired outcome and measurable success criteria.

2. Define Requirements and Monitoring Logic

• Elicit and document business, functional, data and non-functional requirements for each CCM use case.
• Work with control owners to translate control objectives and operating procedures into measurable logic, rules, thresholds, exception criteria and expected outputs.
• Define data sources, required attributes, population and coverage expectations, refresh frequency, dependencies, data-quality checks and evidence requirements.
• Document user stories, process flows, acceptance criteria, reporting needs, escalation paths and remediation workflows.
• Maintain requirements traceability from the underlying control objective through monitoring logic, technical implementation, test results and production outcome.

3. Partner with Engineering to Build Monitoring Routines

• Act as the day-to-day bridge between control owners, cybersecurity teams, engineering teams, data providers and risk stakeholders.
• Work closely with engineers to convert agreed requirements into scalable monitoring routines using available security telemetry and enterprise data.
• Review prototypes and interim outputs with stakeholders to confirm that the routine accurately measures the intended control outcome.
• Drive timely decisions and remove ambiguity that could delay implementation.

4. Validate Outcomes and Drive Go-Live

• Coordinate end-to-end testing, including data validation, logic validation, user acceptance testing and reconciliation against existing control evidence where appropriate.
• Confirm that monitoring outputs are accurate, explainable, actionable and aligned to agreed acceptance criteria.
• Drive resolution of defects, false positives, data gaps, coverage limitations and implementation issues before production release.
• Lead go-live readiness discussions covering ownership, support, reporting, exception management, escalation, remediation and operating procedures.
• Support the transition into business-as-usual operations and capture lessons learned and improvement opportunities after launch.

5. Stakeholder Leadership and Delivery Governance

• Plan and facilitate end-to-end workshops and decision forums with technical and non-technical stakeholders.
• Maintain clear delivery plans, RAID logs, decisions, dependencies, and status reporting across the CCM workstream.
• Communicate progress, risks, recommendations and decisions in a concise manner for senior stakeholders and governance forums.
• Build alignment across teams with different priorities and drive shared accountability for successful outcomes.

Expected Engagement Outcomes

• A prioritized set of ES&F cybersecurity controls suitable for continuous monitoring and automation.
• Complete, traceable requirements and monitoring specifications for agreed CCM use cases.
• Validated monitoring routines that produce accurate, explainable and actionable control outcomes.
• Defined ownership, reporting, exception-management, escalation and operational-support processes.
• Successful production go-live and transition of delivered CCM use cases into sustainable operations.
• Reusable delivery methods, templates and lessons learned that strengthen the ES&F CCM capability.

Qualifications

Must Have

• Demonstrable hands-on experience designing, building or implementing an in-house CCM solution or comparable automated control-monitoring capability.
• Proven experience taking cybersecurity control-monitoring use cases from identification and requirements through engineering build, testing and production go-live.
• robust understanding of cybersecurity controls, control objectives, operating effectiveness, automated evidence and exception-based monitoring.
• Experience translating control language into measurable rules, data requirements, monitoring logic and acceptance criteria.
• Experience working directly with control owners, cybersecurity engineers, data teams and technology stakeholders.
• robust business analysis capabilities, including requirements elicitation, process mapping, workshop facilitation, user stories, acceptance criteria and traceability.
• Demonstrated ability to manage ambiguity, resolve cross-functional issues and drive complex delivery discussions to closure.
• Excellent written, verbal and executive communication skills.

Preferred

• Experience with security telemetry or data from areas such as identity and access management, vulnerability management, endpoint security, cloud security, configuration management or asset inventory.
• Experience with CCM, GRC, risk analytics or control-automation platforms, whether commercial or internally developed.
• Knowledge of relevant cybersecurity and control frameworks such as NIST CSF, CIS Controls, ISO 27001 or COBIT.
• Experience working in an Agile delivery environment and supporting backlog management, sprint ceremonies and user acceptance testing.
• Relevant professional certification such as CISSP, CISA, CRISC, CGRC or equivalent.