Lead, Controls Assurance

Bridgewater Associates•Westport, CT

3d•Onsite

About The Position

The Lead, Controls Assurance is a senior individual contributor on Bridgewater’s Security Governance, Risk, and Compliance (GRC) team. The team supports compliance with security regulations and client obligations, and builds practical understanding and readiness to respond to security risks. The role develops, evaluates, tests, and strengthens the design and operating effectiveness of security controls across the organization. It partners with business units, technology partners, risk owners, and audit teams to maintain effective controls and meet regulatory and compliance obligations. The role oversees execution of the Security department’s controls posture, including identification and mitigation of deficiencies, with a significant focus on controls automation and monitoring. The position is onsite four days per week, flexing between Bridgewater’s NYC and CT offices. The wage range is $225,000 to $375,000, inclusive of base salary and discretionary bonus; expected base salary is 70–80% of that range. Bridgewater does not provide immigration sponsorship for this position.

Requirements

Bachelor’s or Master’s degree in an analytical, scientific, liberal arts, or related field.
7–10 years of experience in risk management, information security, and/or cybersecurity compliance.
Proven track record designing and building controls assurance programs.
Ability to develop and execute strategic visions for a mature controls program.
Ability to synthesize complex ideas and requirements for different audiences and translate conceptual requirements into programmatic implementation and action plans.
Ability to adapt to new business areas and regulatory changes.
Strong ownership mentality and drive for results.
Commitment to truth, openness, excellence, and critically evaluating practical security problems rather than defaulting to check-the-box thinking.
Ability to work in an environment focused on excellence.
Must be able to meet the onsite requirement of four days per week, flexing between NYC and CT offices.

Nice To Haves

CISA, CISSP, or related certifications.
Experience in a highly regulated and fast-paced industry, especially financial services.
Knowledge of U.S. and/or global asset management regulatory contexts.
Knowledge of SOC 1 / SOC 2 criteria, NIST, CIS, applicable regulatory frameworks, internal control frameworks, and control self-assessment best practices.
Experience designing, implementing, and maintaining comprehensive IT and security controls programs.
Knowledge of data analysis tools and techniques used in control testing.
Experience using controls automation platforms to streamline evidence collection, monitoring, and compliance reporting.
Knowledge of audit methodologies, sampling techniques, evidence standards, and remediation tracking.
Exposure to global regulatory regimes beyond U.S. regulators such as the SEC and CFTC.

Responsibilities

Develop and lead Bridgewater’s Controls Assurance Program.
Plan and execute control testing across operational, security, and technology risk areas.
Gather and review process documentation, evidence, control narratives, and risk-control matrices for accuracy and completeness.
Identify control gaps, design weaknesses, and non-compliance, and document findings clearly.
Partner with process and control owners to remediate issues and track remediation to closure.
Support audit requests, including evidence gathering and walkthroughs.
Prepare assurance reports and dashboards summarizing testing results for senior stakeholders.
Improve testing methodologies, sampling approaches, control frameworks, tooling, and automation.
Develop risk metrics and summary reporting for executive leadership.
Stay current on regulatory changes and industry standards that affect the control environment.
Maintain oversight and execution of the Security department’s controls posture, including identifying and mitigating control deficiencies.
Learn business processes and technology use and controls, and manage associated security controls and risks.
Independently plan and execute testing procedures with minimal oversight.
Interpret policies, procedures, and regulatory requirements and apply them to real processes.
Assess control adequacy and risk significance using sound professional judgment.
Communicate difficult or sensitive findings constructively and diplomatically.