Security Control Assurance Lead

Axiom Path, Inc.; Charlotte (NC); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Axiom Path is seeking a Senior Security Control Assurance Engineer in the Charlotte, NC area to lead the design and maturation of a risk-based security control assurance program across critical systems and environments.

You will engineer automated control testing and evidence-collection capabilities, establish continuous controls monitoring, and develop repeatable testing procedures for security, privacy, and data-protection controls to drive measurable improvements.

Qualifications

• 8+ years in cybersecurity assurance, engineering or related fields.
• Hands-on automation of security-control testing and evidence collection.
• Scripting in Python, Rust or Ruby; API integrations.
• Familiar with NIST CSF and ISO 27001.
• Experience with AWS and/or GCP security services.
• Bachelor's degree in CS/Engineering/Info Security.
• Security certifications (CISSP, CISA, CISM, CRISC) preferred.

Responsibilities

• Design and mature a risk-based security control assurance program across critical systems.
• Engineer automated control testing and evidence-collection capabilities via scripting and integrations.
• Establish continuous controls monitoring to surface issues in near real time.
• Develop repeatable testing procedures for security, privacy and data protection controls.
• Evaluate controls against key frameworks and regulations (NIST CSF, ISO 27001, GDPR).
• Connect security, IT, cloud, data, and GRC platforms to centralize evidence and remediation info.
• Automate deficiency intake, ownership, remediation workflows, and control-health reporting.
• Partner with engineering to embed control validation in CI/CD and SDLC processes.
• Define metrics for control coverage, automation, failures, and remediation time.

Skills

Cybersecurity experience

Automation scripting

APIs integration

NIST/ISO knowledge

Cloud security

Communication

Security certifications

Education

Bachelor's degree in CS/Engineering/Info Security

Tools

GRC platforms

Job description

Charlotte, United States

Axiom Path is an AI-first recruiting and staffing firm delivering RPO, MSP, and direct-hire solutions to enterprise clients across the U.S. Our team of experienced recruiters, supported by purpose-built automation, moves faster and communicates better so clients get qualified talent sooner and candidates get a clear, responsive process from first contact to start date.

Job Description

Be Part Of A High-Performing Team

Join a cybersecurity organization transforming the way technology risk and control assurance are managed across core systems and digital environments. The team is moving away from manual, point-in-time compliance exercises toward a more engineering-driven model where controls can be codified, integrated, automatically tested, and continuously monitored.

This position sits at the intersection of cybersecurity engineering, GRC, data protection, and control assurance. It is an opportunity to build the technical foundation that allows security assurance to operate as a live signal rather than an annual audit exercise.

What's In Store For You

• Hybrid Charlotte opportunity with approximately three days onsite each week.
  
• Initial six-month engagement with potential for long-term conversion.
  
• Significant ownership over GRC engineering and continuous-assurance capabilities.
  
• Opportunity to build control-as-code, policy-as-code, automated evidence collection, and continuous controls monitoring capabilities.
  
• Direct partnership with cybersecurity, engineering, IT, Data Governance, Legal, and other business stakeholders.
  
• Opportunity to materially reduce manual control-testing effort while strengthening visibility into cybersecurity and data risk.
  

How You Will Make An Impact

• Design and mature a risk-based security control assurance program across critical systems and technology environments.
  
• Engineer automated control testing and evidence-collection capabilities using scripting, APIs, integrations, and security/GRC platforms.
  
• Establish continuous controls monitoring so failures and control deviations surface closer to real time.
  
• Develop repeatable technical testing procedures for security, privacy, and data-protection controls.
  
• Evaluate controls against frameworks and regulations including NIST CSF, ISO 27001, CCPA/CPRA, and GDPR.
  
• Connect security, IT, cloud, data, and GRC platforms to centralize control evidence, findings, and remediation information.
  
• Continuously assess controls involving access management, encryption, DLP, retention, logging, and sensitive-data protection.
  
• Automate deficiency intake, ownership assignment, remediation workflows, and control-health reporting.
  
• Partner with engineering teams to incorporate security-control validation into CI/CD pipelines, change management, and SDLC processes.
  
• Define metrics around control coverage, automation percentage, failures, remediation time, and overall control effectiveness.
  

Requirements

Do You Have the Expertise to Lead in Security Control Assurance Engineering?

• 8+ years of experience across cybersecurity assurance, security engineering, GRC, security controls, or closely related disciplines.
  
• Demonstrated hands-on experience automating security-control testing and/or evidence collection.
  
• Working scripting or programming capability using Python, Rust, Ruby, or a comparable language.
  
• Hands-on experience connecting enterprise or security platforms through APIs.
  
• Experience with GRC platforms and/or continuous controls monitoring technologies.
  
• Practical knowledge of control-as-code and policy-as-code concepts.
  
• Applied experience with NIST CSF and ISO 27001.
  
• Understanding of CCPA/CPRA, GDPR, and related data-protection requirements.
  
• Familiarity with AWS and/or GCP security, logging, monitoring, or native control services.
  
• Strong understanding of security controls around identity/access, encryption, DLP, retention, and sensitive data.
  
• Ability to communicate effectively with cybersecurity engineers, technology teams, governance stakeholders, Legal, and senior leadership.
  
• Bachelor's degree in Computer Science, Engineering, Information Security, or a related discipline.
  
• CISSP, CISA, CISM, CRISC, or similar security/risk certification strongly preferred.