IT Control Testing Senior Analyst

Texas Capital•Richardson, TX

12d

About The Position

The IT Control Testing Senior Analyst is responsible for executing independent risk-based assessments of technology and cybersecurity controls within the Second Line of Defense (2LOD). This role evaluates the design and operating effectiveness of key technology controls, including IT General Controls (ITGCs), IT Application Controls (ITACs), automated controls, and cybersecurity controls, and assesses the associated risk implications of control deficiencies. The role partners closely with Technology, Information Security, Operational Risk, Compliance, and Internal Audit stakeholders to strengthen the organization's risk and control environment.

Requirements

Minimum 5 years of experience in Technology Risk Management, IT Audit, Controls Testing, Cyber Risk Management, Operational Risk, or Technology Compliance within a regulated environment.
Bachelor’s degree in information technology, Information Systems, Cybersecurity, Business, Accounting, or related discipline.
Demonstrated experience performing independent testing of ITGCs, ITACs, automated controls, and cybersecurity controls.
Strong knowledge of NIST CSF, COBIT, COSO, FFIEC guidance, and SOX IT control principles.
Experience assessing control deficiencies, residual risk, and business impacts.
Experience testing controls related to Access Management, Change Management, SDLC, Technology Operations, Application Security, Data Governance, or Cloud Technologies.
Strong analytical, critical thinking, communication, and executive reporting skills.

Nice To Haves

Banking or financial services experience preferred.
CISA, CRISC, CISSP, CISM, or CIA certifications preferred.
Experience with Archer, ServiceNow, Power BI, or similar preferred tools.

Responsibilities

Evaluate industry standards, regulatory mandates, and legal requirements relevant to technology and information security. Ensure organizational policies, procedures, and frameworks are aligned with these requirements, proactively identifying changes in the regulatory landscape and recommending adaptations as needed.
Execute independent testing of ITGCs, ITACs, automated controls, and cybersecurity controls. Assess control design and operating effectiveness, develop testing procedures, sampling approaches, document conclusions, and perform remediation validation and issue closure testing.
Evaluate control effectiveness in mitigating technology, cyber, operational, regulatory, and data risks. Assess deficiencies for severity, root cause, residual risk exposure, and business impact. Identify emerging risks and systemic control weaknesses.
Provide independent oversight and effective challenge to First Line of Defense stakeholders regarding control design, implementation, testing results, remediation plans, and risk treatment decisions.
Review management action plans, validate corrective actions, challenge closure requests when evidence is insufficient, and ensure remediation addresses root causes and risk exposure.
Prepare testing reports, risk assessments, management summaries, and executive reporting. Clearly articulate risk implications and recommendations to stakeholders and governance committees.
Ensure testing activities align with NIST, COBIT, COSO, FFIEC guidance, SOX expectations, and internal risk management frameworks.
Enhance testing methodologies, reporting capabilities, standards, and quality assurance practices to improve technology risk management maturity.