Analyst, Security Program Strategy Controls Assurance

Edge Services; Vienna (VA); On-site; USD 90,000 - 130,000; Full time

Job summary

Edge Services seeks an Analyst to support Asset Based Testing of IT and Information Security controls within an Agile environment. The role covers planning, scoping, executing and reporting assessments and communicating with business partners and stakeholders.

Responsibilities include developing communications, risk & control matrices, performing walkthroughs, creating test strategies, and documenting work to satisfy reperformance standards, with results presented to leadership.

Qualifications

• Experience in control testing across the three lines of defense (Audit, ERM, First Line).
• Experience in audit and information security risk assessments.
• Knowledge of FFIEC, NIST, ISO and related security frameworks.
• Familiarity with NCUA, FFIEC, GLBA, NIST CSF/800, ISO 27001/27002, SANS/CIS 20 and PCI DSS.
• Experience working with all levels of staff, management and third parties.
• Strong planning and organizational skills.
• Analytical, problem solving and communication abilities.
• Bachelor degree or equivalent; professional certifications preferred.
• Certifications: CISSP, CISA, CCSP, CRISC or equivalent.
• Ability to present findings clearly and build professional relationships.
• Proficient with word processing and spreadsheets.

Responsibilities

• Plan and scope Asset Based Assessments with communications, risk & control matrices and scope documents.
• Perform walkthroughs with business partners identifying actual vs. expected controls.
• Create test strategies to test actual controls.
• Document all work to meet IIA reperformance standards.
• Document issues and final reports.
• Present assessment results to leadership.
• Provide additional duties to support the program.

Skills

Audit experience

Information security

Risk assessments

Communication skills

Analytical skills

Planning

Organizational skills

Problem solving

Presentation skills

Interpersonal skills

Word processing & spreadsheets

Education

Bachelor degree in business, information systems or related field or equivalent work/military experience

CISSP

CISA

CCSP

CRISC

Job description

Job Description – add details here

Basic Purpose

The Analyst will serve in an Asset Based Testing role that will help plan, scope, execute, and report testing of IT and Information Security controls. The Analyst will be responsible for all phases of the assessment and communications with business partners and other stakeholders. They will work in an Agile environment.

Responsibilities

• Planning & Scoping of Asset Based Assessments to include development of communications, risk & control matrices, scope documents and other supporting information
• Perform walk-throughs with business partners identifying actual versus expected controls
• Create test strategies to test actual controls
• Document all work performed to meet the IIA reperformance standard
• Document issues and final reports
• Present to leadership results of assessments
• Any other duties as assigned to support the program

Qualifications

• Experience in control testing to include experience in some of the three lines of defense (Audit, ERM, First Line areas)
• Experience in audit and information security risk assessments
• Knowledge of applicable federal and state laws, rules and regulations (i.e. Federal Financial Institutions Examination Manual (FFIEC), National Information of Standards and Technology (NIST), and International Standards Organization (ISO)
• Knowledge of NCUA, FFIEC, GLBA, NIST (including the Cyber Security Framework and 800 Series), ISO 27001/27002, SANS/CIS 20, PCI DSS, and other Information Security requirements and frameworks
• Experience in working with all levels of staff, management, stakeholders, and third parties
• Effective planning and organizational skills
• Effective research, analytical and problem solving skills
• Strong verbal, written and interpersonal communication skills, including technical writing
• Bachelor Degree in business, information systems or related field or equivalent work/military experience
• CISSP, CISA, CCSP, CRISC or other Information Security certifications
• Ability to present findings and conclusions clearly and concisely
• Experience in working with all levels of staff, management, stakeholders, and third parties
• Ability to build effective relationships through rapport, trust, diplomacy, and tact
• Strong word processing and spreadsheet software skills

Bank Secrecy Section

Remains cognizant of and adheres to Navy Federal policies, procedures and regulations pertaining to the Bank Secrecy Act.

Skills and Requirements – add details here