Cybersecurity Control Testing Lead, VP
Core
Lead a team to plan, execute, and report results for technology control testing across cloud and on-premises environments, ensuring controls align with regulatory and internal policy requirements.
Role type
Senior IC cybersecurity control testing lead (team management)
Builds
Production ML models | product features | dashboards & analysis | infrastructure
Domain
Financial services + cybersecurity GRC
Deliverable
production ML models | product features | dashboards & analysis | infrastructure
Required skills
Technology risk assessment, IT audit, cybersecurity control testing, cloud security, infrastructure security, team leadership, risk-based assurance methodologies, software development lifecycle practices, secure delivery methods, deployment controls, release management, production change governance, access management, privileged access, change management, vulnerability management, logging and monitoring, encryption, backup and recovery, incident response, configuration management, network security, AI model assessment strategy, evidence-based testing, technical control concepts, documentation quality, audit-ready conclusions, management reporting, risk and control forums, continuous improvement of control testing function
Preferred skills
None stated
Technologies
Cloud platforms, hybrid environments, on-premises infrastructure, servers, databases, network devices, endpoints, applications, data centers, identity and access management, network segmentation, encryption, key management, logging, monitoring, workload protection, vulnerability remediation, backup and recovery, secure configuration baselines, deployment pipeline controls, code review, testing, release management, change approvals, segregation of duties
Responsibilities
Lead and manage a team responsible for control testing activities across cloud, hybrid, and on-premises environments; Set testing strategy, define annual and quarterly priorities, oversee risk-based test plans, and ensure test scripts, walkthrough procedures, evidence requests, sampling approaches, and testing documentation are consistent and defensible; Manage direct reports by setting goals, assigning work, reviewing deliverables, providing coaching, supporting career development, and maintaining accountability for quality, timeliness, and risk-based judgment; Assess control design and operating effectiveness by reviewing system configurations, architecture patterns, policies, procedures, tickets, logs, screenshots, reports, and other supporting evidence; Drive continuous, automated control monitoring and assurance to reduce manual, point-in-time validation; Evaluate technical controls across cloud platforms, including identity and access management, network segmentation, encryption, key management, logging, monitoring, workload protection, vulnerability remediation, backup and recovery, and secure configuration baselines; Evaluate on-premises technical controls across servers, databases, network devices, endpoints, applications, data centers, and supporting infrastructure; Review software development lifecycle and secure delivery controls, including secure design, threat modeling, code review, testing, deployment pipeline controls, release management, change approvals, segregation of duties, and production deployment governance; Identify control gaps, evidence deficiencies, design weaknesses, and operating issues, document clear observations, risk impacts, root causes, and practical remediation recommendations; Work extensively with Cybersecurity GRC, compliance, audit, application, infrastructure, cloud engineering, and security architecture stakeholders to validate control performance, align on testing expectations, resolve control evidence questions, and support consistent issue treatment; Provide leadership, coaching, and technical guidance to control testers, analysts, and stakeholders on testing methodology, evidence standards, technical control concepts, documentation quality, and audit-ready conclusions; Own testing progress, issue status, remediation themes, management reporting, audit readiness, risk and control forums, assurance routines, and continuous improvement of the control testing function
Seniority
Senior, hands-on IC with team management
