Cybersecurity Cloud Control Testing Lead, VP

MUFG • Jersey City, NJ

5d • $144,000 - $194,000 • Hybrid

About The Position

The Cybersecurity Cloud Control Testing Lead will lead a team that plans, executes, documents, and reports technology control testing across cloud, hybrid, and on-premises environments. The role manages direct reports, establishes testing priorities, oversees the quality of testing, and promotes consistent control-testing practices across technical domains. It requires technical knowledge of cybersecurity, cloud security architecture and controls, infrastructure control design, software development lifecycle practices, and risk-based assurance methodologies, including the ability to assess cloud architectures and validate the implementation and effectiveness of cloud-native controls across AWS, Microsoft Azure, and Oracle Cloud Infrastructure (OCI).

As part of the broader Cybersecurity GRC control assurance operating model, the role directs testing activities, develops team capability, influences control quality, and provides insight to engineering, security architecture, application, infrastructure, audit, risk, and compliance stakeholders. The lead works closely with Cybersecurity GRC to align testing priorities, evidence standards, issue rationale, reporting expectations, and remediation themes, supporting controls that are appropriately designed, effective, supported by reliable evidence, and aligned with regulatory, internal policy, and industry-framework requirements.

The position follows a hybrid schedule: four days per week at an MUFG office or client site and one day working remotely. The typical annual base pay range is $147,000–$194,000 in New York/New Jersey and $144,000–$180,000 elsewhere, depending on job-related factors. The role may also be eligible for discretionary performance-based bonus or incentive compensation. MUFG describes a benefits package that includes health and wellness benefits, retirement plans, educational assistance and training, income replacement for eligible employees with disabilities, paid maternity and parental bonding leave, and paid vacation, sick days, and holidays. Visa sponsorship or support is not anticipated for this position.

Requirements

• At least 10 years of experience in technology risk, IT audit, cybersecurity, control testing, cloud security, infrastructure security, or related technical assurance roles, including experience leading teams or managing direct reports.
• Strong understanding of cloud and hybrid control environments and practical technical knowledge of AWS, Microsoft Azure, and/or OCI security services, networking, cloud IAM, encryption, monitoring, workload security, and cloud governance controls.
• Strong understanding of AI models and ability to define and execute an appropriate assessment strategy.
• Experience testing technical controls, including access and privileged access management, change management, vulnerability management, logging and monitoring, encryption, backup and recovery, incident response, configuration management, and network security.
• Experience evaluating cloud-native security controls and architectures in AWS, Azure, and/or OCI, including IAM, network security, cloud configuration management, monitoring, vulnerability management, encryption, container and Kubernetes security, and cloud governance.
• Strong understanding of SDLC practices, secure delivery methods, deployment controls, release management, and production change governance.
• Working knowledge of infrastructure-as-code technologies such as Terraform, CloudFormation, ARM/Bicep, or equivalent cloud deployment frameworks.
• Ability to lead testing teams, manage performance, review workpapers, develop talent, resolve execution blockers, and maintain consistent quality across concurrent testing activities.
• Strong analytical judgment and ability to assess control design and operating effectiveness using evidence-based testing.
• Ability to interpret technical evidence and translate findings, risk themes, control gaps, and remediation trends into clear documentation, leadership messaging, and actionable management reporting.
• Ability to engage cloud engineering, platform engineering, DevSecOps, and security architecture teams in technical discussions about cloud control design, implementation, monitoring, and remediation.
• Strong communication and stakeholder-management skills, including the ability to engage technical and non-technical audiences, constructively challenge control design, and influence outcomes.
• Ability to manage multiple testing workstreams, prioritize risk-based activities, escalate risks appropriately, and deliver quality outcomes within established timelines.
• Working knowledge of industry frameworks and cloud security standards, including NIST, CIS Benchmarks, CSA Cloud Controls Matrix, ISO 27001, and cloud-provider security best practices.
• Bachelor’s degree in Computer Science, Information Security, Information Systems, Engineering, or a closely related discipline, or an equivalent combination of education and experience.
• Demonstrated technical understanding of cloud platforms and cloud security beyond policy, governance, or audit activities, including the ability to evaluate implementations, interpret technical cloud evidence, assess architectures, and challenge and influence cloud engineering and security teams on control effectiveness and risk remediation.

Nice To Haves

• AWS Certified Security – Specialty.
• AWS Solutions Architect Professional or Associate.
• Microsoft Azure Security Engineer Associate.
• Microsoft Azure Solutions Architect Expert.
• Oracle Cloud Infrastructure Security Professional.
• Certified Cloud Security Professional (CCSP).
• Certificate of Cloud Security Knowledge (CCSK).
• Certified Information Systems Security Professional (CISSP).
• Certified Information Systems Auditor (CISA).

Responsibilities

• Lead and manage a team conducting control testing across cloud, hybrid, and on-premises environments, including cloud services, infrastructure, identity and access, configuration, logging, monitoring, vulnerability management, and change management controls.
• Set testing strategy and annual and quarterly priorities; oversee risk-based test plans and ensure consistency and defensibility of test scripts, walkthroughs, evidence requests, sampling, and documentation.
• Manage direct reports by setting goals, assigning work, reviewing deliverables, coaching, supporting career development, and maintaining accountability for quality, timeliness, and risk-based judgment.
• Assess control design and operating effectiveness by reviewing system and cloud configurations, architecture diagrams, infrastructure-as-code deployments, policies, procedures, tickets, logs, screenshots, cloud security reports, and other evidence.
• Drive continuous and automated control monitoring and assurance capabilities to reduce manual, point-in-time validation.
• Evaluate technical controls across cloud platforms, including IAM, network segmentation, encryption, key management, logging, monitoring, workload protection, vulnerability remediation, backup and recovery, and secure configuration baselines.
• Assess cloud architectures and security configurations across AWS, Azure, and OCI, including networking, security groups, IAM services, cloud-native logging and monitoring, key management, storage, containers, and cloud governance.
• Validate cloud-native security control implementation and effectiveness through technical review of configurations, architecture patterns, control automation, security tooling, CSPM outputs, and platform-generated evidence.
• Evaluate on-premises technical controls across servers, databases, network devices, endpoints, applications, data centers, and supporting infrastructure.
• Review SDLC and secure delivery controls, including secure design, threat modeling, code review, testing, deployment pipelines, release management, change approvals, segregation of duties, and production deployment governance.
• Review infrastructure-as-code deployment controls and assess risks from configuration drift, unauthorized changes, deployment automation failures, and cloud provisioning practices.
• Identify control gaps, evidence deficiencies, design weaknesses, and operating issues; document observations, risk impacts, root causes, and practical remediation recommendations.
• Work with Cybersecurity GRC, compliance, audit, application, infrastructure, cloud engineering, and security architecture stakeholders to validate control performance, align testing expectations, resolve evidence questions, and support consistent issue treatment.
• Provide leadership, coaching, and technical guidance on testing methodology, evidence standards, cloud security, technical control validation, documentation quality, and audit-ready conclusions.
• Own testing progress, issue status, remediation themes, management reporting, audit readiness, risk and control forums, assurance routines, and continuous improvement of the control-testing function.

Benefits

• Comprehensive health and wellness benefits.
• Retirement plans.
• Educational assistance and training programs.
• Income replacement for qualified employees with disabilities.
• Paid maternity and parental bonding leave.
• Paid vacation, sick days, and holidays.
• Potential eligibility for discretionary performance-based bonus and/or incentive compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior