Cybersecurity Controls Testing Analyst, Deloitte Global Technology
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Hybrid
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, Engineering, or a related field.
- Relevant certifications such as ISO 27001 Lead Auditor, CISA, CRISC, Security+, or similar are desirable
- 2–4 years of professional experience in information security, IT risk management, internal audit, compliance, or controls testing roles.
- Experience conducting compliance testing, audits, or control assessments against internal or external standards (e.g., ISO 27001, NIST, CIS Controls, SOC 2).
- Working knowledge of automated control testing tools (e.g., Qualys, Tenable, Rapid7, or similar platforms).
- Experience with GRC or ITSM platforms such as ServiceNow, Archer, MetricStream, or similar for control and remediation tracking.
- Experience with Microsoft security tooling (e.g., Defender for Endpoint, Intune, Sentinel) and/or KQL query writing is advantageous.
- Experience working in a large, global, matrixed organisation is an advantage.
Full description
##
Deloitte Global is the engine of the Deloitte network. Our professionals reach across disciplines and borders to develop and lead global initiatives. We deliver strategic programs and services that unite our organization.
What will your typical day look like?
As a Cybersecurity Controls Testing Analyst, you will support DT's Controls Assurance Testing Programme by validating the design and operating effectiveness of security controls through a combination of automated and manual testing. Working closely with the Cyber Compliance Manager and technical stakeholders, you will help translate regulatory, policy, and industry-standard requirements into measurable controls, identify opportunities to automate testing through data and system integrations, and perform evidence-based assessments where automation is not feasible. You will also support the validation of remediation activities, helping drive control deficiencies through to closure and contributing to reporting and governance activities.
The ideal candidate will bring a combination of technical cyber security experience and GRC or compliance expertise. You will have hands-on experience in areas such as cyber operations, infrastructure, cloud, security engineering, or security administration, and the technical acumen to understand how controls are designed, implemented, and evidenced in practice. Experience supporting compliance, audit, controls assurance, or risk management activities is essential, along with the ability to assess whether technical controls effectively satisfy regulatory, policy, and industry-standard requirements.
Key Responsibilities
- Support the execution of DT's Controls Assurance Testing Programme through a combination of automated and manual control testing activities.
- Translate regulatory, policy, and industry standard requirements into measurable control objectives, helping define how compliance requirements should be implemented and evidenced within technology environments.
- Partner with technical teams to understand the design and operation of security controls across identity, endpoint, network, infrastructure, cloud, and security operations domains.
- Identify opportunities to automate control testing through integrations with security and technology platforms, leveraging system data wherever possible to support continuous assurance and reduce manual testing effort.
- Develop and maintain automated testing logic, technical validation queries, control mappings, and evidence requirements to support repeatable and scalable testing activities.
- Perform manual control effectiveness testing where automation is not feasible, including evidence collection, validation, sampling, and assessment against defined testing criteria.