Controls Analyst

Passfort; Gurugram District; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Moody’s in Gurugram, India, seeks a Controls Analyst to lead AI risk assessments and end-to-end control evaluations. You will review governance, security, and data-exposure controls for AI tools and integrations, and coordinate with technology, legal, and risk stakeholders to drive remediation.

The role requires 2–4 years in AI risk, strong communication skills, and familiarity with governance standards such as NIST AI RMF and ISO/IEC 42001.

Qualifications

• 2–4 years in AI risk or related risk disciplines, ideally in financial services or global orgs.
• Ability to assess AI solutions, identify risks, and form clear, defendable conclusions.
• Strong knowledge of AI risk concepts and governance frameworks.
• Communicate complex risk concepts to tech and non-tech stakeholders.
• Familiar with AI tech, cloud environments, APIs, data flows, and controls.

Responsibilities

• Execute end-to-end control assessments: planning, walkthroughs, evidence reviews, testing, and reporting.
• Conduct AI risk assessments for tools and AI-enabled apps to evaluate governance and security.
• Review vendor assurance docs (SOC, ISO, trust-center) for risk posture.
• Develop and review RCSAs with risk statements and evidence-based conclusions.
• Support ISO/IEC 27001:2022 readiness and internal audits.
• Prepare clear assessment reports with findings and remediation suggestions.
• Collaborate with control owners, product and tech teams to drive remediation and maintain docs.

Skills

AI risk management

AI governance

Information security

GRC

Risk assessment

Stakeholder communication

Cloud technologies

Data analytics

Education

Bachelor’s degree in CS/IS/Engineering

ISO/IEC 42001 Lead Auditor/Implementer

CISA

CISSP

ISO/IEC 27001 Lead Auditor/Implementer

Tools

Power BI

Power Automate

ServiceNow

OpenPages

OneTrust

Microsoft Office

Microsoft Copilot

Job description

Controls Analyst

Gurugram, India

Skills and Competencies

• 2-4 years of experience in AI risk management, AI governance, technology risk, model risk, IT audit, information security, GRC, or a related discipline, ideally within financial services, a Big Four firm, or a global organization
• Experience assessing AI solutions, AI-enabled applications, agents, and emerging technologies, with the ability to evaluate risks, controls, and supporting evidence to develop clear, defensible conclusions
• Strong knowledge of AI risk concepts, including prompt injection, hallucinations, sensitive data exposure, bias, explainability, model drift, shadow AI, third-party dependencies, and human oversight requirements
• Familiarity with AI governance, risk, and compliance frameworks such as NIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP Top 10 for LLM Applications, and other evolving regulatory standards
• Ability to communicate complex technical and risk concepts effectively to both technical and non-technical stakeholders while collaborating across technology, cybersecurity, legal, compliance, privacy, procurement, and business teams
• Working understanding of AI technologies, cloud environments, APIs, integrations, access controls, data flows, and automation tools, with proficiency in Microsoft Office and exposure to platforms such as Power BI, Power Automate, ServiceNow, OpenPages, OneTrust, or Microsoft Copilot

Education

• Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related discipline
• Professional certifications such as ISO/IEC 42001 Lead Auditor/Implementer, ISO/IEC 27001 Lead Auditor/Implementer, CISA, AAIA, AISM, AAIR, CISSP, or CRISC are preferred

Responsibilities

• Execute end-to-end control assessments, including planning, walkthroughs, evidence reviews, testing, issue validation, and reporting activities.
• Conduct AI risk assessments for AI tools, AI-enabled applications, agents, connectors, plugins, and model-driven solutions to evaluate governance, security, data exposure, autonomy, and oversight controls
• Analyze vendor assurance documentation, including SOC reports, ISO certifications, trust-center materials, security documentation, and technical architecture evidence to assess risk and compliance posture
• Develop and review Risk and Control Self-Assessments (RCSAs), documenting risk statements, control mappings, effectiveness evaluations, evidence-based conclusions, and residual risk assessments
• Support ISO/IEC 27001:2022 readiness reviews, internal audits, and continuous control monitoring activities by evaluating policies, procedures, technical configurations, and operational evidence
• Prepare clear and actionable assessment reports, identifying findings, risks, observations, and improvement opportunities supported by appropriate evidence and recommendations
• Partner with control owners, product teams, technology teams, and risk stakeholders to facilitate assessments, communicate outcomes, and drive remediation efforts and maintain accurate assessment documentation, workpapers, issue logs, evidence repositories, and governance reporting within approved GRC and collaboration platforms
  Leverage data analytics, automation, and approved AI tools to enhance assessment efficiency, reporting quality, consistency, and operational effectiveness and stay informed on emerging developments in AI, cybersecurity, regulatory requirements, and risk management practices, translating insights into practical control assessment approaches

About the Team
Our Internal Controls team plays a critical role in strengthening Moody’s control environment by evaluating and enhancing the effectiveness of controls that mitigate financial, cybersecurity, operational, and emerging technology risks. We partner with stakeholders across the organization to drive compliance, resilience, and continuous improvement through a disciplined and risk-focused approach.
As part of this team, you will have the opportunity to work on innovative AI governance and risk initiatives, collaborate with global teams, and contribute to the development of a robust control framework that supports Moody’s strategic objectives. This role offers strong exposure to emerging technologies, ongoing professional development, and the opportunity to make a meaningful impact in a rapidly evolving risk landscape.