Systems Engineer Security

Role Overview This contractor will support a strategic GRC modernization initiative focused on simplifying and standardizing the ES&F control environment and enabling a more scalable, risk-based, and automation-ready control framework.

Key Responsibilities & Outcomes

• Support the GRC Modernization Program in designing and standardizing the future-state cybersecurity control framework across Enterprise Security & Fraud.
• Review existing policies, standards, risks, audit findings, regulatory requirements, and controls to identify gaps, redundancies, and improvement opportunities.
• Design and document risk-based, measurable, and testable controls, including control objectives, activities, ownership, evidence requirements, and implementation guidance.
• Rationalize and standardize controls across functions and identify opportunities for automation and Continuous Controls Monitoring (CCM).
• Facilitate working sessions with security, technology, risk, compliance, audit, and business stakeholders to develop and align on future-state control designs.

Qualifications & Requirements

Required:

• 7-8 years of experience in cybersecurity, risk management, GRC, controls design, internal audit, or related disciplines, preferably within financial services or another highly regulated industry.
• Demonstrated experience designing, enhancing, or transforming cybersecurity controls and translating policies, standards, risks, audit findings, and regulatory requirements into effective control designs.
• Strong understanding of the control lifecycle, including design, implementation, testing, monitoring, and remediation.
• Experience with recognized cybersecurity/control frameworks such as NIST CSF, NIST 800-53, ISO 27002, CIS Controls, and/or COBIT.
• Strong analytical, documentation, facilitation, and stakeholder-management skills.

Preferred:

• Experience with control automation or Continuous Controls Monitoring.
• Experience supporting large-scale GRC modernization, control transformation, or cybersecurity governance initiatives.
• Experience developing control libraries, taxonomies, framework mappings, or enterprise control standards.
• Experience designing controls with automation and Continuous Controls Monitoring (CCM) in mind.
• Consulting, risk advisory, internal audit, or Big Four experience is strongly preferred.
• Professional certifications such as CISSP, CISM, CISA, CRISC, CIA, or CPA are a plus.