Sr Controls Analyst

Moody's Investors Service; Gurugram District; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Moody's Investors Service seeks a Senior Cybersecurity Assurance Lead to drive risk-based audits across applications, infrastructure, cloud, and hybrid environments, validating ISO 27001 controls and evidencing results.

You will mentor teams, partner with global stakeholders, and apply data analytics to enhance assurance coverage, with 5+ years in cybersecurity, IT audits, or risk management and preferred certifications such as CISA or CISSP.

Qualifications

• 5+ years in cybersecurity, IT audits, or risk management.
• Experience assessing design and operating effectiveness of controls across apps, infra, cloud, and hybrid environments.
• Proven ability to conduct vulnerability management, SIEM, DLP, IAM, and network security reviews.
• Strong stakeholder management, communication, and project leadership capabilities.

Responsibilities

• Lead and execute risk-based cybersecurity audits and readiness reviews across environments.
• Conduct ISO 27001-focused assessments and validate control design and effectiveness.
• Evaluate risks and identify control gaps using established frameworks and methodologies.
• Facilitate stakeholder interviews and communicate findings and remediation expectations.
• Develop and maintain Risk and Control Matrices (RCMs) and testing methodologies.
• Perform root cause analysis and provide risk-based remediation recommendations.
• Maintain organized repositories of policies, evidence, and audit results.
• Mentor and coach team members to strengthen capabilities and accountability.

Skills

Cybersecurity/IT Audits

Control frameworks

Control assessment

Security tools

AI/Automation

Leadership/Stakeholder

Education

Bachelor's Degree in IT/CS/Security

ISO 27001 Lead Auditor

CISA/CISSP or equivalent

Job description

At Moody's, we unite the brightest minds to turn today’s risks into tomorrow’s opportunities. We do this by striving to create an inclusive environment where everyone feels welcome to be who they are—with the freedom to exchange ideas, think innovatively, and listen to each other and customers in meaningful ways. Moody’s is transforming how the world sees risk. As a global leader in ratings and integrated risk assessment, we’re advancing AI to move from insight to action—enabling intelligence that not only understands complexity but responds to it. We decode risk to unlock opportunity, helping our clients navigate uncertainty with clarity, speed, and confidence.

Skills and Competencies

• 5+ years of experience in Cybersecurity, IT Audits, Cyber Controls Testing, Risk Management, or Information Security Assurance
• Strong expertise in cybersecurity control frameworks including NIST CSF, ISO 27001, CIS Controls, OWASP, cloud security, and data governance practices
• Proven ability to assess the design and operating effectiveness of preventive, detective, and corrective controls across applications, infrastructure, cloud, and hybrid environments
• Hands-on knowledge of vulnerability management, secure configuration reviews, SIEM, DLP, IAM, network security, and remediation practices.
• Experience leveraging AI, automation, and data analytics to enhance testing efficiency, monitoring capabilities, and assurance coverage.
• Excellent stakeholder management, communication, project management, analytical thinking, and team leadership skills, with the ability to manage multiple priorities in a global environment

Education

• Bachelor's Degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field
• ISO 27001 Lead Auditor certification required
• Professional certifications such as CISA, CISSP, AWS Security, Microsoft Security, OSCP, or equivalent are strongly preferred

Responsibilities

• Lead and execute risk-based cybersecurity audits, controls assessments, and readiness reviews across applications, infrastructure, cloud, and hybrid environments
• Conduct ISO 27001-focused assessments and validate the design and operating effectiveness of cybersecurity controls across business and technology functions and perform audit planning, scoping, control mapping, evidence collection, testing, documentation, reporting, and remediation validation activities
• Evaluate cybersecurity risks and identify control gaps using established frameworks, threat scenarios, and risk assessment methodologies and assess secure configurations, vulnerability management programs, identity and access management controls, network security controls, DLP solutions, and SIEM capabilities
• Facilitate walkthroughs, stakeholder interviews, and audit closeout meetings to communicate findings, control weaknesses, and remediation expectations.
• Develop and maintain Risk and Control Matrices (RCMs), testing methodologies, continuous assurance programs, and audit standards and monitor process, technology, and organizational changes that may impact the company's cybersecurity posture and control environment
• Perform root cause analysis and impact assessments for identified issues and provide risk-based recommendations to strengthen controls and support regulatory requests, management reporting, board-level materials, and cybersecurity governance activities
• Maintain organized repositories of policies, test evidence, audit documentation, and assessment results while providing status updates to stakeholders and drive continuous improvement initiatives by applying data analytics, automation, business intelligence, and innovative assurance techniques.
• Build strong partnerships with stakeholders across business and technology functions and provide guidance on cybersecurity risk and control matters and mentor and coach team members, fostering professional development, accountability, and knowledge sharing within the team.

About the Team

The Internal Controls Department provides independent assurance and advisory services designed to strengthen Moody’s control environment and support operational excellence. Through a disciplined and risk-focused approach, the team evaluates the design and effectiveness of controls related to material financial, cybersecurity, and operational risks.
The team plays a critical role in helping the organization manage risk, maintain regulatory compliance, and improve business processes across global operations. By collaborating with stakeholders across functions and regions, the team delivers valuable insights that enhance resilience, accountability, and governance.
As a member of the team, you will have the opportunity to contribute to high-impact internal control evaluations, risk management assessments, and advisory initiatives while working with global stakeholders to support Moody’s commitment to integrity, compliance, and continuous improvement.

Moody’s is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected veteran status, sexual orientation, gender expression, gender identity or any other characteristic protected by law.
Candidates for Moody's Corporation may be asked to disclose securities holdings pursuant to Moody’s Policy for Securities Trading and the requirements of the position. Employment is contingent upon compliance with the Policy, including remediation of positions in those holdings as necessary.