Cybersecurity Controls Testing Lead (Hybrid)

Deloitte (UK); Alabama; Hybrid; USD 86,000 - 119,000; Full time

Job summary

Deloitte UK seeks a Cybersecurity Controls Testing Analyst to support the Controls Assurance Testing Programme by validating the design and operating effectiveness of security controls across identity, endpoint, network, infrastructure, cloud, and security operations.

You will translate regulatory requirements into measurable control objectives and collaborate with technical teams to ensure robust evidence and testing coverage.

Qualifications

• Bachelor’s degree in information systems, Computer Science, Cybersecurity, Engineering, or a related field.
• Certifications such as ISO 27001 Lead Auditor, CISA, CRISC, Security+ are desirable.
• Proven experience in information security, IT risk, audits, compliance, or controls testing.
• Experience with regulatory standards (ISO 27001, NIST, CIS, SOC 2) and automated control testing tools.
• Knowledge of ServiceNow or similar ITSM/GRC platforms for tracking control and remediation.

Responsibilities

• Support the Controls Assurance Testing Programme with automated and manual testing.
• Translate regulatory requirements into measurable control objectives for technology enviroments.
• Collaborate with technical teams across identity, endpoints, networks, cloud and security operations.
• Develop automated testing logic and evidence requirements for repeatable testing.
• Validate remediation activities and track deficiencies through closure.

Skills

Cybersecurity experience

GRC / compliance knowledge

Controls testing experience

Regulatory / policy understanding

Education

Bachelor's degree in information systems, Computer Science, Cybersecurity, Engineering, or related

ISO 27001 Lead Auditor

CISA

CRISC

Security+

Tools

Qualys

Tenable

Rapid7

ServiceNow

Archer

MetricStream

Defender for Endpoint

Intune

Sentinel

KQL

Job description

Deloitte UK seeks a Cybersecurity Controls Testing Analyst to support the Controls Assurance Testing Programme by validating the design and operating effectiveness of security controls across identity, endpoint, network, infrastructure, cloud, and security operations.

You will translate regulatory requirements into measurable control objectives and collaborate with technical teams to ensure robust evidence and testing coverage.