GRC Cybersecurity Controls Analyst

TikTok Inc.; Washington (District of Columbia); On-site; USD 89,000 - 176,000; Full time

Job summary

TikTok USDS Joint Venture is seeking a GRC Cybersecurity Controls Analyst to join the GRC Controls & Certifications team. You will evaluate control design, operating effectiveness, and support audit readiness across cybersecurity, financial services, and regulatory obligations.

The role focuses on control testing, evidence review, and coordinating with control owners, product teams, and auditors, including areas like ISO 27001, SOC 2, PCI-DSS, and MTL obligations, with an emphasis on automation

Qualifications

• Bachelor’s degree or equivalent practical experience.
• 3+ years in GRC, IT risk, security controls, audit readiness, or related field.
• Experience with control testing, compliance, audit readiness, or risk management in regulated environments.

Responsibilities

• Maintain and improve controls framework descriptions, mappings, owners, evidence expectations, testing procedures, and narratives.
• Perform internal and external cybersecurity controls testing across ISO 27001, PCI-DSS, SOC 2, NIST CSF, and related frameworks; assess design and operating effectiveness.
• Support testing and documentation of controls in financial services and regulated payments (PCI-DSS, MTL) and audit-readiness activities.
• Map controls across cybersecurity, financial services, and regulatory requirements to reduce duplication and ensure coverage.
• Review submitted evidence to verify control performance and audit readiness.
• Coordinate with owners, product teams, and stakeholders to resolve evidence gaps and improve testing quality.
• Support GRC automation initiatives by defining requirements for workflow automation and scalable testing processes.
• Collaborate with security, engineering, and data teams to understand tools and evidence sources for automated validation.
• Contribute to high-quality documentation and defensible controls testing culture.

Skills

GRC controls

Audit readiness

Control testing

Regulatory frameworks

Documentation/writing

Cross-functional collaboration

Security controls

Education

Bachelor’s degree in related field

Job description

About the Team

TikTok is seeking a GRC Cybersecurity Controls Analyst to join the TikTok USDS Joint Venture (JV) GRC Controls & Certifications team. This role will support the operation, testing, and continuous improvement of the controls framework with a focus on cybersecurity, financial services, and regulated payments-related obligations, including Money Transmitter License (MTL)/PCI-DSS control expectations where applicable. This role will help drive audit readiness across key security, compliance, privacy, and regulatory obligations.

About the Role

The candidate will work closely with control owners, product teams, security teams, privacy, legal, internal audit, external auditors, and GRC leadership to evaluate control design, implementation, and operating effectiveness. The role will support control testing, evidence review, audit response coordination, control narrative development, and issue identification across cybersecurity, financial services, and regulatory frameworks such as ISO 27001, SOC 2, NIST CSF, PCI-DSS, Money Transmitter License (MTL) obligations, and other applicable security, compliance, privacy, and payments related assessment activities.

The candidate will also help mature the team’s approach to GRC automation and engineering. This includes improving how controls are mapped, tested, monitored, and reported through tooling, dashboards, structured data, workflow automation, evidence recommendations, and scalable testing. The ideal candidate is comfortable working at the intersection of GRC, security controls, audit readiness, and process automation.

Responsibilities

• Support the maintenance and continuous improvement of the controls framework, including control descriptions, mappings, owners, evidence expectations, testing procedures, and control narratives.
• Execute internal and external cybersecurity controls testing across frameworks such as ISO 27001, PCI-DSS, SOC 2, NIST CSF, and related internal control frameworks, including assessment of control design, operating effectiveness, evidence sufficiency, and remediation tracking.
• Support testing and documentation of controls relevant to financial services and regulated payments activities, including PCI-DSS and MTL-related obligations, compliance evidence, control mappings, and audit-readiness activities.
• Map controls across cybersecurity, financial services, and regulatory requirements to reduce duplication, identify coverage gaps, and maintain a defensible integrated control framework.
• Review evidence submitted by control owners and product teams to determine whether it sufficiently demonstrates control performance and meets audit or assessment expectations.
• Coordinate with control owners, evidence owners, product teams, and GRC stakeholders to resolve evidence gaps, clarify control intent, and improve testing quality.
• Support GRC automation initiatives by helping define requirements for workflow automation, control monitoring, and scalable control testing processes.
• Work with technical and engineering teams to understand security tools, data sources, system-generated evidence, and opportunities to automate or improve control validation.
• Contribute to a culture of high-quality documentation, defensible controls testing, and continuous improvement across the Controls & Certifications function.

Qualifications

Minium Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, Compliance, Engineering, Data Analytics, or a related discipline, or equivalent practical experience.
• 3+ years of experience in GRC, IT risk, security controls, audit readiness, control testing, compliance, security assurance, or a related field.
• Experience supporting control testing, compliance, audit readiness, or risk management in a financial services, fintech, payments, banking, or similarly regulated environment. Working knowledge of cybersecurity control testing for standards and frameworks such as ISO 27001, PCI-DSS, SOC 2, NIST CSF, or equivalent.
• Familiarity with financial services regulatory obligations, including PCI-DSS, Money Transmitter License (MTL) requirements, payments compliance, consumer protection, safeguarding, transaction monitoring, or related controls. Ability to evaluate whether technical and operational evidence demonstrates compliance with control intent, regulatory expectations, and audit requirements
• Experience gathering, reviewing, and assessing technical control evidence from stakeholders, systems, tools, dashboards, or documentation repositories. Familiarity with security domains such as Identity and Access Management, Vulnerability Management, Incident Management, Asset Management, Logging and Monitoring, Data Security, SDLC, Third-Party Risk Management, Business Continuity / Disaster Recovery, or Privacy.
• Strong writing and documentation skills, with the ability to create clear control narratives, evidence and testing summaries, and status updates. Strong analytical skills and ability to assess whether evidence meets the intent of a control, requirement, or audit request.
• Experience working with control owners, technical teams, auditors, legal, privacy, compliance, or cross-functional stakeholders. Ability to manage multiple workstreams, follow up on open items, identify blockers, and communicate risks clearly and demonstrated teamwork and collaboration skills, especially in fast-moving, cross-functional environments.

Preferred Qualifications

• Professional certification such as CISA, CISSP, CISM, CRISC, CDPSE, ISO 27001 Lead Auditor / Lead Implementer, or equivalent.
• Direct experience supporting PCI-DSS and/or MTL audits, exams, licensing obligations, or financial services compliance programs
• Experience supporting external audits, security certifications, or regulatory assessments such as SOC 2, ISO 27001, NIST CSF, or national security / data protection obligations.
• Experience testing controls related to payments, funds movement, customer data protection, access management, transaction monitoring, incident response, vendor risk, business continuity, or data security in a regulated financial services environment.
• Experience with GRC automation, control monitoring, evidence automation, dash boarding, workflow design, or data-driven control testing.
• Experience working with legal, compliance, risk, audit, engineering, security, infrastructure, product, or data teams to translate technical processes into control evidence and audit-ready narratives.
• Familiarity with automation, scripting, SQL, APIs, or data workflows used to improve GRC operations.

About USDS

TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on the apps we operate. The Joint Venture has been established in compliance with the Executive Order signed by President Trump on September 25, 2025. Our foundation is a comprehensive data privacy and cybersecurity program we operate under defined safeguards to protect national security and secure U.S. user data, apps and the algorithm. We safeguard the U.S. content ecosystem, holding decision-making authority for trust and safety policies and moderation. USDS Joint Venture helps ensure Americans can continue to express their creativity, discover new hobbies and interests, and build thriving communities and businesses on a global scale.

On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.

Why Join Us

Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.

We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an Always Day 1 mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.

Diversity & Inclusion

TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.

USDS Reasonable Accommodation

USDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA

Job Information

【For Pay Transparency】 Compensation Description (Annually) - Washington, DC

The base salary range for this position in the selected city is $ 88920 - $ 176400 annual.

Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.

Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).

The Company reserves the right to modify or change these benefits programs at any time, with or without notice.