Lead Audit/Compliance Analyst

Audit And Compliance Lead IVMust have Lead RCSA experience. Strong understanding of RCSA methodology, risk and control concepts, control design, testing, issues, and remediation. 8+ years of experience in technology risk management, IT controls, operational risk, RCSA execution, control testing, internal audit, risk governance, or related disciplines.

Preferred certifications include CISA, CRISC, CIA, CISM, CISSP, CGEIT, COBIT, ITIL, ISO 27001, or relevant cloud security certifications. Strong communication.Description:The Audit and Compliance Lead IV will support the administration, execution, and documentation uplift of the Technology RCSA program.The incumbent will facilitate RCSA workshops, review risks and controls against standard requirements, identify documentation and control gaps, and work with Technology and First Line of Defense stakeholders to drive items to resolution.This role will also support control articulation enhancements, review testing scripts against proposed control language changes, recommend testing-script uplifts, maintain the Risk and Control Matrix inventory, assist with RCM and process-map updates, and help facilitate required change management protocols.The role is aligned to the IT risk and control quality expectations reflected in the source job description, including RCSA quality, control testing review, evidence-based challenge, stakeholder engagement, and governance discipline.Key Responsibilities:RCSA Workshop Administration Plan, coordinate, and facilitate RCSA working sessions.Prepare agendas, discussion materials, action trackers, and follow-up documentation.Capture workshop outcomes, decisions, open items, owners, and target dates.Track action items through resolution and escalate delays or unresolved matters as appropriate.Promote consistency in how risks, controls, gaps, and remediation actions are documented.Gap Review and Resolution Review existing RCSA documentation against applicable standards and control documentation requirements.Assess whether risks are clearly defined and whether controls are appropriately mapped to the stated risks.Identify missing, outdated, duplicative, unclear, or unsupported control documentation.Work with Technology and First Line of Defense stakeholders to address documentation gaps.Document gap assessment results, proposed remediation actions, and closure status.Control Articulation Enhancements Review existing control language and propose enhancements to improve precision and auditability.Ensure control statements clearly describe the control activity, owner, frequency, scope, evidence, and expected outcome.Distinguish true control activities from process steps, procedures, standards, or general oversight activities.Vet proposed enhancements with First Line of Defense stakeholders and incorporate feedback.Support finalization of revised control language for review and approval.Testing Script Review and Uplift Review testing scripts against revised or proposed control articulation.Assess whether test steps align to the control objective, frequency, evidence, population, sampling approach, and expected result.Identify testing-script gaps, including unclear procedures, incomplete evidence requirements, weak sampling guidance, or unsupported conclusions.Recommend practical testing-script uplifts.Assist with Technology control testing where warranted, including evidence review, test execution support, exception documentation, and results validation.RCM Inventory, Process Maps, and Change Management Maintain the RCM inventory for assigned Technology processes and control areas.Ensure RCMs reflect current risks, controls, owners, frequencies, evidence requirements, testing expectations, and process linkages.Help update RCMs and process maps to reflect current-state processes, control points, systems, handoffs, and ownership.Maintain traceability between RCSA documentation, RCMs, process maps, testing scripts, issues, and change records.Support change management protocols for updates to control documentation, RCMs, testing scripts, and process maps.Coordinate stakeholder review, approvals, version control, change logs, and implementation tracking.Job Experience:8+ years of experience in technology risk management, IT controls, operational risk, RCSA execution, control testing, internal audit, risk governance, or related disciplines.Experience facilitating workshops and/or leading walkthroughs with Technology stakeholders, control owners, process owners, risk partners, and First Line of Defense teams.Strong experience reviewing risk and control documentation against standards and identifying gaps.Experience drafting or enhancing control language to improve clarity, completeness, testability, and auditability.Experience reviewing testing scripts and recommending improvements.Familiarity with RCM inventory management, process mapping, control libraries, risk taxonomies, and change management protocols.Experience with Technology control domains such as access management, change management, cybersecurity, infrastructure, applications, data protection, IT operations, or third-party technology risk.Must-Have Requirements:Strong understanding of RCSA methodology, risk and control concepts, control design, testing, issues, and remediation.8+ years of experience in technology risk management, IT controls, operational risk, RCSA execution, control testing, internal audit, risk governance, or related disciplines.Ability to facilitate structured workshops and drive open items to resolution.Strong documentation skills and ability to write clear, testable control language.Ability to identify gaps between current-state documentation and standard requirements.Strong analytical skills with attention to detail.Ability to translate technical Technology processes into clear risk and control language.Strong stakeholder management and communication skills.Ability to work effectively with First Line of Defense teams and Technology SMEs.Ability to manage multiple deliverables and produce high-quality work within agreed timelines.Preferred Certifications: (nice to haves)Preferred certifications include CISA, CRISC, CIA, CISM, CISSP, CGEIT, COBIT, ITIL, ISO 27001, or relevant cloud security certifications.