Senior IT Controls Testing & Risk Analyst

BankUnited; Florida; On-site; USD 110,000 - 160,000; Full time

Job summary

BankUnited seeks an experienced 2LoD risk professional to advance and maintain the Controls Testing Program. You will independently assess IT and Cybersecurity controls, provide credible challenge to control owners, and report findings to management and stakeholders.

The role collaborates with IT, Information Security, Risk Management, Compliance, and Internal Audit to strengthen the control environment and support regulatory examinations.

Qualifications

• Minimum 4-6 years of experience in controls testing, IT audit, cybersecurity, technology risk, compliance, or related disciplines.
• Experience performing control design assessments, control effectiveness evaluations, and remediation validation activities.
• Experience evaluating IT and Cybersecurity controls and documenting observations, findings, and recommendations.
• Experience developing, implementing, executing, and maintaining controls testing, validation, or oversight program preferred.
• Experience coordinating penetration testing engagements preferred.
• Experience working within banking, financial services, or other highly regulated industries preferred.
• Experience interacting with auditors, regulators, and senior management preferred.

Responsibilities

• Develops, implements, maintains, and continuously enhances the Controls Testing Program.
• Establishes and maintains methodologies, standards, procedures, and support documentation for independent assessments and testing activities.
• Executes independent assessments to evaluate the design and effectiveness of IT and Cybersecurity controls.
• Evaluates controls against internal policies, regulatory requirements, and industry-recognized frameworks.
• Provides credible challenge to First Line of Defense control owners regarding control effectiveness and remediation activities.
• Analyzes and documents assessment results, identify control gaps, root causes, and risk themes, and determine remediation priorities.
• Validates corrective actions and prepares clear, concise, and actionable reports that communicate findings and recommendations to management and stakeholders.
• Supports internal audits, external audits, regulatory examinations, and inquiries by providing documentation and supporting evidence.
• Monitors emerging threats, technology risks, regulatory developments, audit observations, and industry practices and incorporate relevant changes into methodologies and program coverage.
• Identifies opportunities to enhance assessment methodologies through automation, analytics, and approved AI-enabled capabilities.
• Coordinates internal and external penetration testing engagements, including scope, objectives, and testing requirements.
• Reviews penetration testing results, assess the adequacy of remediation plans and corrective actions, and maintain supporting documentation and historical records.
• Supports other Second Line of Defense Cyber and Technology Risk activities as assigned.
• Adheres to and complies with applicable, federal and state laws, regulations and guidance, including those related to anti-money laundering (i.e. Bank Secrecy Act, US PATRIOT Act, etc.).
• Adheres to Bank policies and procedures and completes required training.
• Identifies and reports suspicious activity.

Skills

Controls testing

IT audit

Cybersecurity

Technology risk

Regulatory compliance

Communication

Analytical thinking

Education

Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Risk Management, or a related field preferred

Tools

NIST CSF

NIST SP 800-53

CIS Controls

FFIEC guidance

Job description

BankUnited seeks an experienced 2LoD risk professional to advance and maintain the Controls Testing Program. You will independently assess IT and Cybersecurity controls, provide credible challenge to control owners, and report findings to management and stakeholders.

The role collaborates with IT, Information Security, Risk Management, Compliance, and Internal Audit to strengthen the control environment and support regulatory examinations.