IT Risk & Controls Testing Analyst - Assistant Manager

HM Revenue & Customs (HMRC); Belfast City District, Cardiff, Milton Keynes, Reading; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Deloitte UK is seeking an experienced IT risk and controls professional to join our Compliance team. You will perform control testing across identity, endpoint, network, and infrastructure, and contribute to remediations and governance.

You will collaborate with global teams, utilize ServiceNow and GRC tools, and stay aligned with ISO 27001, NIST, CIS Controls, and SOC 2 standards to protect clients and the firm.

Qualifications

• Proven experience in information security, IT risk management, internal audit, compliance, or controls testing roles.
• Experience conducting compliance testing against ISO 27001, NIST, CIS Controls, or SOC 2.
• Working knowledge of automated control testing tools such as Qualys, Tenable, Rapid7.
• Experience with GRC or ITSM platforms such as ServiceNow, Archer, or MetricStream.
• Experience with Microsoft security tooling and/or KQL query writing is advantageous.
• Experience in a large, global, matrixed organization.
• Knowledge of risk and compliance methodologies and cybersecurity fundamentals.
• Strong analytical and communication skills.
• Ability to manage multiple priorities in a fast-paced environment.
• Collaborative across global teams.

Responsibilities

• Support control testing program and automated testing across security controls.
• Maintain control testing framework, mappings, queries, and pass/fail criteria.
• Perform control testing across identity, endpoint, network, and infrastructure.
• Assess risk gaps and prioritize remediation with risk-based approach.
• Validate remediation activity evidence submitted by risk and control owners.
• Follow up with owners to close remediation and escalate overdue items.
• Identify and report control gaps, risks, and non-compliance to stakeholders.
• Maintain ServiceNow workflows for remediation tracking.
• Collaborate with cross-functional stakeholders to align with ISO/NIST/SOC2.
• Assist Compliance Manager with testing updates, KPI dashboards, and templates.
• Stay current on testing methodologies and regulatory developments.

Skills

Information security

IT risk management

Internal audit

Compliance

Controls testing

GRC tools

ServiceNow

KQL queries

Security tooling

Education

Bachelor's degree

Cybersecurity related field

Tools

Qualys

Tenable

Rapid7

ServiceNow

Archer

MetricStream

Job description

Deloitte UK is seeking an experienced IT risk and controls professional to join our Compliance team. You will perform control testing across identity, endpoint, network, and infrastructure, and contribute to remediations and governance.

You will collaborate with global teams, utilize ServiceNow and GRC tools, and stay aligned with ISO 27001, NIST, CIS Controls, and SOC 2 standards to protect clients and the firm.