The opportunity

The Technology Assurance, Risk, and Policy (TARP) function within Information Security strives to create and promote a holistic Governance, Risk, and Compliance (GRC) program by creating a robust, resilient, and proactive governance framework, supported by a strategic risk management approach and stringent compliance structures. It aims to integrate and align its GRC initiatives in line with the global firm's objectives and emerging threats within the cybersecurity landscape.

Furthermore, the Policy, Risk, and Controls (PRC) Enablement & Awareness team aims to establish policies and procedures that reflect the value we place on safeguarding our digital environment, while ensuring that these policies are effectively communicated and enforced across all levels of the organization. The Control & Risk Assessment team sits within PRC Enablement & Awareness and aims to directly enables the GRC program by designing control testing and risk assessment methodology to measure and quantify compliance to policies and control objectives.

Your

key responsibilities

The Control & Risk Assessment Specialist will be expected to leading and executing control testing plans, following the model for 1st line and 2nd line testing best-practice strategies. They will be responsible for routinely testing and assesses the effectiveness and efficiency of Information Security controls put in place to mitigate risks to determine if they are supporting the desired business outcomes. Test plans include, but are not limited to, self-assessment questionnaires, control testing, and process assessments.





The Control & Risk Assessment Specialist is also responsible for managing and training a team of junior professionals to assist in executing the test plans. The Control & Risk Assessment team will work collectively to support the Information Security Program in the areas of risk assessment methodology development and execution of risk assessments, control testing design and execution, and identification of gaps and areas of improvement utilizing testing and assessment results.

Collaboration with other Information Security groups and external stakeholders across EY is key to this role. The primary service offering the Control & Risk Assessment Specialist will oversee is the Member Firm and Application Technology Risk Self-Assessment Program, requiring extensive collaboration with stakeholders outside of InfoSec across various integral locations, time zones, and service lines. There will also be requirements to partner with other multi-departmental and multi-level stakeholders inclusive of, but not limited to Information Security, Client and Enterprise Technology, Data Protection, Global and Enterprise Risk Management, Internal Audit, Area and Regional Risk & Data teams, Service Line Quality Leaders, etc.

Skills and attributes for success

Create and design test plans for a variety of Information Security controls across the full scope of a Technology Risk Universe Based on results of assessments and testing,



assist control owners with the design and implementation of their controls in the organization's IT environment. Strategize on the appropriate amount of preventive, detective, or corrective controls which will have the most impact on reducing overall risk for the firm. Appropriately balance firm security needs with business impact and benefit when recommending advancements in policy and control objectives and directing those efforts to completion. Think strategically to assist with the development of a long-term vision for the Control & Risk Assessment Program Act as a thought leader in the firm, staying informed of changes in information security, regulatory requirements, audit standards, and industry trends, adjusting strategies, as necessary. Build and maintain appropriate relationships with internal and external leaders to ensure awareness and understanding of potential strategic directions. Flexibility to adjust to multiple demands, shifting priorities, ambiguity, and rapid change. Outstanding management, interpersonal, communication, organizational, and decision-making skills. Ability to understand and integrate cultural differences and motives and to lead cross cultural teams. Evaluate, counsel, mentor and provide feedback on performance of others. Plan the training and development of staff to develop their skills and maintain state-of-the-art knowledge in information security. Demonstrate integrity and judgment within a professional environment.

To qualify for the role you must have

3+ years of experience in the Information Technology, Information Security and/or Risk Management field(s). Audit experience or a demonstrated a

📌 Security Control Assessor (Buenos Aires)
🏢 EY
📍 Buenos Aires