Key Responsibilities:

Partner with cybersecurity control owners and SMEs to identify controls suitable for continuous monitoring and automation.
Assess controls based on risk, maturity, repeatability, data availability, monitoring feasibility, and assurance value.
Translate control objectives into measurable monitoring rules, logic, thresholds, exception criteria, and acceptance criteria.
Define data sources, attributes, coverage, refresh frequency, data-quality checks, dependencies, and evidence requirements.
Create user stories, process flows, functional/data requirements, acceptance criteria, and requirements traceability.
Partner directly with engineering and data teams to build scalable automated monitoring routines.
Validate monitoring outputs for accuracy, explainability, actionable exceptions, and alignment with control objectives.
Coordinate data validation, logic testing, UAT, reconciliation, defect resolution, and false-positive remediation.
Drive production go-live, including ownership, reporting, exception management, escalation, remediation, and operational handoff.
Facilitate workshops and manage RAID items, dependencies, decisions, and stakeholder communication.

Required Experience / Proficiency:

Continuous Controls Monitoring (CCM): Hands-on experience designing/building/implementing CCM or automated control monitoring.
CCM End-to-End Delivery: Must have taken monitoring use cases from requirements through build, testing/UAT and production go-live.
Cybersecurity Controls: Strong understanding of control objectives, operating effectiveness, automated evidence and exception-based monitoring.
Monitoring Logic & Automation: Ability to translate controls into measurable rules, thresholds, data requirements and acceptance criteria.
Business Analysis: Strong requirements elicitation, process mapping, workshops, user stories, acceptance criteria and traceability.
Technical Stakeholder Management: Hands-on collaboration with control owners, cybersecurity engineering, data and technology teams.

Preferred:

Security telemetry/data exposure across IAM, vulnerability management, endpoint security, cloud security, configuration management, or asset inventory.
CCM, GRC, risk analytics, or control-automation platforms.
Knowledge of NIST CSF, CIS Controls, ISO 27001, or COBIT.
Agile delivery, backlog management, sprint ceremonies, and UAT.
CISSP, CISA, CRISC, CGRC, or similar certification.

Profiles to Avoid:

Please do not send generic Business Analysts, GRC analysts, auditors, compliance professionals, or reporting/governance profiles who have only worked around controls.
The key differentiator is actual hands-on CCM / automated control-monitoring implementation experience, including defining monitoring logic and taking use cases into production.

Suggested Profiles/Titles to Target:

Continuous Controls Monitoring Business Analyst.
CCM Business Analyst.
Cybersecurity Controls Automation Business Analyst.
Cyber GRC Automation Business Analyst.
Controls Automation Consultant / Analyst.
Technology Risk & Controls Automation Business Analyst.
When sharing profiles, please highlight the candidate's specific CCM project, what controls they automated, their role in defining monitoring logic/data requirements, and whether they took the solution through production go-live.

Senior Business Analyst - Continuous Controls Monitoring (CCM)

Key skills