Security Assurance Analyst – Control Evidence Review

Houston Skilled Consultancy; Singapore; Hybrid; SGD 70,000 - 100,000; Full time

Job summary

Houston Skilled Consultancy is seeking a detail-oriented Security Assurance Analyst – Control Evidence Review. The role focuses on reviewing control evidence, validating control effectiveness, and identifying compliance gaps to strengthen the organization’s information security posture.

You will work with cybersecurity, IT operations, risk management, compliance, internal audit, and business teams to ensure evidence supports control performance.

Qualifications

• Bachelor's degree in Cybersecurity, IT, Computer Science or related discipline preferred.
• Equivalent professional experience and relevant training may be considered.
• Certifications such as CISA, CRISC, ISO 27001 Lead Auditor are advantageous but not mandatory.

Responsibilities

• Collect, organize, and review evidence for information security controls.
• Verify evidence is complete, current, relevant and aligned with control requirements.
• Assess controls against ISO 27001, NIST CSF, SOC 2 where relevant.
• Map evidence to control objectives and assessment criteria.
• Identify deviations and elevate significant concerns to stakeholders.
• Prepare evidence review summaries and control assessment reports.
• Coordinate with control owners to obtain missing evidence and track remediation actions.

Skills

Attention to detail

Analytical thinking

Documentation review

Evidence validation

Risk assessment

Education

Bachelor's degree in Cybersecurity/IT/CS

Professional certifications advantageous (e.g., CISA, ISO 27001)

Tools

Excel

Word

PowerPoint

Audit/evidence management tools

Job description

1. Job Summary

Houston Skilled Consultancy is seeking a detail-oriented and analytical Security Assurance Analyst – Control Evidence Review to support information security governance, risk management, compliance monitoring, and internal assurance activities. The successful candidate will be responsible for reviewing security control evidence, validating the effectiveness of implemented controls, identifying compliance gaps, and ensuring that supporting documentation meets established security policies, regulatory requirements, and industry standards.

In this role, the Security Assurance Analyst will work closely with cybersecurity, IT operations, risk management, compliance, internal audit, and business teams to evaluate whether security controls are appropriately designed, implemented, and operating effectively. The position requires a structured approach to evidence collection, documentation review, risk assessment, issue tracking, and remediation monitoring.

The ideal candidate will have a strong understanding of information security principles, security control frameworks, audit procedures, and evidence validation techniques. They should be comfortable examining technical and procedural records, identifying inconsistencies, documenting findings, and communicating recommendations to relevant stakeholders.

This position offers an opportunity to contribute to a stronger security posture, improve organizational accountability, and support continuous improvement in cybersecurity assurance processes.

2. Key Responsibilities

Security Control Evidence Review

• Collect, organize, and review evidence supporting the implementation and operation of information security controls.
• Examine policies, procedures, access reviews, system configurations, audit logs, vulnerability reports, incident records, and other relevant documentation.
• Verify that submitted evidence is complete, accurate, current, relevant, and aligned with defined control requirements.
• Confirm that evidence demonstrates actual control performance rather than relying solely on policy statements or undocumented assurances.
• Identify missing documents, outdated records, inconsistent information, and insufficient evidence that may affect assurance conclusions.
• Maintain clear records of evidence reviewed, validation procedures performed, and review outcomes.

Security Assurance and Compliance

• Assess security controls against applicable internal policies, contractual obligations, and recognized frameworks such as ISO 27001, NIST Cybersecurity Framework, and SOC 2 criteria, where relevant.
• Support internal security assessments, compliance reviews, customer assurance requests, and external audit preparation.
• Evaluate whether security controls are appropriately designed and operating as intended.
• Assist in mapping control evidence to specific control objectives, assessment criteria, and compliance requirements.
• Identify deviations from established security standards and elevate significant concerns to the appropriate stakeholders.
• Help ensure that assurance activities follow consistent methodologies and documented review procedures.

Risk Identification and Gap Analysis

• Identify control weaknesses, evidence deficiencies, process gaps, and potential compliance risks.
• Document findings with clear descriptions, supporting evidence, potential impacts, and recommended corrective actions.
• Assist with risk assessments by evaluating the significance of identified control deficiencies.
• Differentiate between administrative documentation issues and deficiencies that may indicate an underlying security control failure.
• Support the prioritization of findings according to risk severity, business impact, and remediation urgency.
• Track recurring issues and highlight patterns that may require broader corrective action.

Remediation Tracking and Follow-Up

• Coordinate with control owners to obtain missing evidence and clarify discrepancies.
• Monitor remediation plans, action owners, agreed deadlines, and supporting documentation.
• Review submitted corrective-action evidence to determine whether identified deficiencies have been adequately addressed.
• Escalate overdue actions, unresolved control gaps, and repeated evidence-quality issues.
• Maintain accurate remediation trackers and prepare status updates for management.
• Support closure decisions by ensuring that corrective actions are supported by sufficient and verifiable evidence.

Documentation and Reporting

• Prepare evidence review summaries, control assessment reports, compliance status updates, and management-ready findings.
• Maintain organized evidence repositories with appropriate version control, access restrictions, and traceability.
• Ensure that assessment conclusions can be traced to the evidence reviewed and the criteria applied.
• Develop and maintain evidence request lists, review checklists, control matrices, and assessment templates.
• Assist in preparing audit documentation and responding to requests from internal auditors, external assessors, and authorized stakeholders.
• Recommend improvements to evidence collection, documentation standards, and review workflows.

Stakeholder Collaboration

• Work with cybersecurity, infrastructure, application, identity and access management, and IT service management teams to understand control requirements.
• Communicate evidence expectations and explain deficiencies to control owners in a clear and constructive manner.
• Participate in security assurance meetings, compliance reviews, audit walkthroughs, and remediation discussions.
• Help stakeholders understand the importance of maintaining reliable evidence and demonstrating ongoing control effectiveness.
• Collaborate with cross-functional teams to improve control ownership, accountability, and readiness for future assessments.

Continuous Improvement

• Identify opportunities to streamline evidence collection and reduce repetitive manual review activities.
• Support the development of standardized review procedures and quality assurance practices.
• Monitor changes in security requirements and assessment methodologies relevant to assigned responsibilities.
• Contribute to improvements in governance, risk, and compliance processes.
• Promote a culture of accuracy, transparency, accountability, and continuous security improvement.

3. Required Skills and Qualifications

Educational Qualifications

A bachelors degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline is preferred.

Equivalent professional experience and relevant technical training may be considered.

Professional certifications such as CompTIA Security+, ISO 27001 Foundation or Lead Auditor, CISA, CRISC, or relevant risk and compliance credentials are advantageous but may not be mandatory.

Technical Skills

• Understanding of information security principles, including confidentiality, integrity, and availability.
• Knowledge of security control design, implementation, monitoring, and testing.
• Familiarity with security governance, risk management, compliance assessments, and audit evidence requirements.
• Ability to review technical and procedural documentation for completeness, consistency, and relevance.
• Understanding of identity and access management, privileged access controls, vulnerability management, change management, incident management, and security monitoring.
• Familiarity with control frameworks such as ISO 27001, NIST CSF, NIST SP 800-53, and SOC 2, depending on organizational requirements.
• Proficiency in Microsoft Excel or comparable spreadsheet tools for evidence tracking, data validation, and reporting.
• Working knowledge of Microsoft Word, PowerPoint, and collaboration platforms for preparing documentation and communicating findings.
• Familiarity with governance, risk, and compliance (GRC) platforms, audit management systems, ticketing tools, or evidence management repositories is an advantage.

Analytical and Review Skills

• Strong attention to detail when examining records and validating supporting evidence.
• Ability to compare evidence against defined control requirements and identify gaps or inconsistencies.
• Sound judgment when evaluating whether evidence adequately supports an assessment conclusion.
• Ability to organize large volumes of information and maintain accurate review records.
• Strong problem-solving skills and a structured approach to investigation and issue resolution.

Communication Skills

• Clear written communication for documenting findings, recommendations, and assessment results.
• Ability to explain technical control requirements to both technical and non-technical stakeholders.
• Professional communication when requesting additional information or challenging incomplete evidence.
• Ability to collaborate with multiple teams while maintaining independence and objectivity in review activities.

4. Experience

Entry-level candidates: Applicants with foundational cybersecurity knowledge, relevant academic projects, internships, or training in IT audit, information security, or compliance may be considered for junior-level opportunities.

Preferred experience: Approximately 1–3 years of experience in security assurance, IT audit, cybersecurity compliance, risk management, control testing, or a related field.

Experience reviewing control evidence, preparing audit documentation, maintaining compliance trackers, or supporting remediation activities is highly desirable.

Exposure to ISO 27001, NIST, SOC 2, or other recognized security assessment requirements is beneficial.

Experience working with cross-functional IT and security teams is an advantage.

Familiarity with evidence management tools, GRC platforms, audit workflows, or issue-tracking systems is preferred.

Candidates should demonstrate a willingness to learn, a commitment to accurate documentation, and the ability to apply structured review procedures consistently. The level of responsibility assigned will depend on the candidates qualifications and experience.

5. Working Hours

Work Schedule: Full-time position, subject to the agreed employment arrangement.

Typical Hours: Monday to Friday, approximately 40 hours per week, depending on business requirements.

Work Arrangement: Remote, hybrid, or office-based, depending on the positions approved location and operational needs.

Flexibility: Occasional flexibility may be required to accommodate audit deadlines, stakeholder meetings, or scheduled compliance reviews.

Overtime: Additional hours may occasionally be necessary during major assessments or reporting periods, subject to company policy and applicable employment regulations.

Collaboration: Employees may need to coordinate with teams operating across different time zones.

The final working schedule, employment location, and applicable leave arrangements will be communicated during the recruitment process.

6. Knowledge, Skills, and Abilities

Understanding of cybersecurity governance, risk, and compliance principles.

Knowledge of security control objectives and evidence-based assessment practices.

Familiarity with internal audit processes, compliance requirements, and control testing methodologies.

Awareness of common security risks, including unauthorized access, inadequate change control, weak vulnerability management, and insufficient monitoring.

Understanding of documentation standards, evidence traceability, and remediation processes.

Awareness of confidentiality requirements and the appropriate handling of sensitive organizational information.

Skills

• Evidence collection, classification, validation, and documentation.
• Control mapping and assessment against established requirements.
• Gap analysis, issue tracking, and remediation verification.
• Report writing, spreadsheet management, and information organization.
• Stakeholder communication and follow-up coordination.
• Prioritization of review activities against deadlines and risk levels.
• Use of structured checklists, review templates, and quality assurance procedures.

Abilities

• Ability to work methodically while managing multiple control reviews and competing priorities.
• Ability to maintain objectivity and confidentiality when handling sensitive evidence.
• Ability to identify discrepancies and ask relevant questions to clarify incomplete information.
• Ability to distinguish between documented control requirements and evidence demonstrating actual implementation.
• Ability to work independently while collaborating effectively with control owners and assurance teams.
• Ability to adapt to evolving security standards, internal processes, and business requirements.
• Ability to communicate findings accurately without overstating the significance of the available evidence.

7. Benefits

Houston Skilled Consultancy aims to provide a professional environment that supports employee development and effective performance. Depending on the employment contract, role location, and applicable company policies, potential benefits may include:

• Competitive Compensation: Salary aligned with the roles responsibilities, relevant experience, qualifications, and market conditions.
• Professional Development: Opportunities to strengthen cybersecurity assurance, IT audit, risk management, and compliance expertise.
• Certification Support: Potential access to relevant training resources or certification assistance, subject to company policy.
• Flexible Work Options: Remote or hybrid arrangements where approved for the position.
• Collaborative Work Environment: Opportunities to work with professionals across cybersecurity, IT operations, governance, and compliance.
• Career Development: Opportunities to develop specialist knowledge in security control testing, audit readiness, and risk assurance.
• Performance Recognition: Potential recognition for quality work, dependable delivery, and contributions to process improvement.
• Leave and Employee Support: Applicable leave entitlements and other benefits in accordance with the employment agreement and local regulations.
• Specific benefits, eligibility requirements, and compensation details will be confirmed by the employer during the hiring process.

8. Why Join Houston Skilled Consultancy?

Joining Houston Skilled Consultancy as a Security Assurance Analyst – Control Evidence Review offers an opportunity to build valuable expertise at the intersection of cybersecurity, governance, risk, and compliance.

The role is suited to professionals who enjoy investigating details, organizing complex information, identifying weaknesses, and helping organizations demonstrate that their security controls are working effectively.

Key reasons to consider this opportunity include:

• Meaningful Security Contributions: Help strengthen organizational security by ensuring that control assessments are supported by reliable, verifiable evidence.
• Broad Professional Exposure: Develop experience across security governance, compliance monitoring, control testing, and audit readiness.
• Continuous Learning: Build familiarity with recognized security frameworks, assurance methodologies, and evolving industry expectations.
• Cross-Functional Collaboration: Work with technical and business stakeholders to improve security practices and accountability.
• Analytical Career Development: Strengthen critical thinking, risk assessment, documentation, and professional reporting skills.
• Opportunities for Progression: With relevant experience and demonstrated performance, potential career paths may include Senior Security Assurance Analyst, IT Auditor, GRC Analyst, Information Security Risk Analyst, or Security Compliance Specialist.

Houston Skilled Consultancy seeks professionals who value integrity, accuracy, teamwork, and continuous improvement. Candidates who are motivated to develop their cybersecurity assurance capabilities are encouraged to apply.