IT Risk & Controls Testing Lead

Deloitte (UK); Alabama; Hybrid; USD 80,000 - 119,000; Full time

Benefits offered by this job

Hybrid working policy

Job summary

Deloitte UK invites applications for a controls testing role focused on information security and IT risk management. This position emphasizes automated and manual testing of security controls across identity, endpoint, network and infrastructure, with strong collaboration across global teams.

You will contribute to ongoing compliance validation against ISO 27001, NIST, CIS Controls, and SOC 2, using tools like Qualys, Tenable, Fastpath and ServiceNow for remediation tracking.

Qualifications

• Proven experience in information security, IT risk management, internal audit, compliance or controls testing.
• Experience conducting compliance testing against internal or external standards (ISO 27001, NIST, CIS Controls, SOC 2).
• Knowledge of automated control testing tools (e.g., Qualys, Tenable, Rapid7 or similar).
• Experience with GRC/ITSM platforms such as ServiceNow, Archer, MetricStream or similar.

Responsibilities

• Support execution of the Control Testing Program, including automated and manual testing of security controls.
• Maintain and update the control testing framework, including mappings, queries, and pass/fail criteria.
• Perform control testing across identity, endpoint, network and infrastructure controls with evidence collection and documentation.
• Apply risk management to understand how tested controls reduce risk and aid remediation prioritization.
• Collaborate with stakeholders to ensure testing is well-evidenced and aligned to industry standards (ISO 27001, NIST SP 800-53, CIS, SOC 2).

Job description

Deloitte UK invites applications for a controls testing role focused on information security and IT risk management. This position emphasizes automated and manual testing of security controls across identity, endpoint, network and infrastructure, with strong collaboration across global teams.

You will contribute to ongoing compliance validation against ISO 27001, NIST, CIS Controls, and SOC 2, using tools like Qualys, Tenable, Fastpath and ServiceNow for remediation tracking.