[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"job-cybersecurity-control-testing-amp-cri-maturity-assessor-avp-mufg-global-service-private-limited-de-in":3},{"id":4,"slug":5,"title":6,"description":7,"company":8,"is_featured":11,"featured_until":7,"is_active":12,"deactivated_at":7,"is_enriched":12,"processed_job_posting_json":13,"processed_latitude":66,"processed_longitude":68,"processed_employment_types":70,"processed_working_hours":71,"processed_working_hours_labels":73,"processed_home_office":74,"processed_salary_min":75,"processed_salary_max":76,"processed_salary_currency":77,"processed_salary_source":78,"processed_benefits":79,"processed_benefits_labels":83,"processed_industry":84,"processed_skills":7,"processed_job_location":85,"processed_full_address_gmaps":87,"processed_street_gmaps":89,"processed_city_gmaps":91,"processed_postal_code_gmaps":93,"processed_country_gmaps":95,"processed_country_iso_code_gmaps":97,"full_description":17,"formatted_description":99,"processed_employment_types_labels":23,"processed_home_office_labels":21,"processed_industry_labels":25,"processed_it_skills":100,"processed_it_skills_labels":103,"processed_soft_skills":104,"processed_soft_skills_labels":105,"processed_job_expertise_skills":106,"processed_job_expertise_skills_labels":107,"processed_language_requirements":108,"processed_total_experience_years":115,"processed_professional_field":116,"processed_professional_field_labels":119,"processed_leadership_role":11,"processed_date_posted":20,"raw_job_url":120,"apply_url":7,"raw_hiringOrganization_logo_url":7,"translations":7,"canonical_industry_key":84,"canonical_industry_label":25,"max_cpc":121,"actual_cpc":7},49321,"cybersecurity-control-testing-amp-cri-maturity-assessor-avp-mufg-global-service-private-limited","Cybersecurity Control Testing & CRI Maturity Assessor - AVP",null,{"name":9,"slug":10,"logo_url":7},"MUFG Global Service Private Limited","mufg-global-service-private-limited",false,true,{"@context":14,"@type":15,"title":16,"description":17,"hiringOrganization":18,"datePosted":20,"jobLocationType":21,"employmentType":22,"industry":24,"skills":26,"baseSalary":57,"validThrough":65},"https:\u002F\u002Fschema.org\u002F","JobPosting","Cybersecurity Control Testing & CRI Maturity Assessor - AVP","Do you want your voice heard and your actions to count? Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world. With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career. Join MUFG, where being inspired is expected and making a meaningful impact is rewarded. Job Summary: This role is a member of the CISO of America’s team within the Cybersecurity GRC function and is responsible for executing independent control testing, control assessments, and validation activities across both on-premises and cloud environments. The role performs CRI Profile maturity assessments, validates key security controls embedded within the SDLC (e.g., secure design, secure configuration, vulnerability management, and change\u002Frelease controls), and evaluates evidence to confirm control design and operating effectiveness. The role also conducts third-party\u002Fvendor cybersecurity assessments with a focus on control validation and documented test results. Roles and Responsibilities Primary Responsibilities: Assessment Planning & Scoping: Plan and execute control testing engagements by defining scope, test approach, sampling, and evidence requirements for on-premises and cloud-based control environments. Control Testing & Validation (On-Prem & Cloud): Test control design and operating effectiveness using evidence-based procedures (e.g., walkthroughs, inquiry, inspection, observation, and re-performance) across identity, network, endpoint\u002Fserver, data protection, logging\u002Fmonitoring, vulnerability management, and configuration\u002Fchange management for both on-premises and cloud platforms. CRI Profile Maturity Assessments: Perform CRI Profile maturity assessments by mapping controls to CRI requirements, evaluating evidence, determining maturity ratings, and documenting gaps and improvement opportunities. Third-Party\u002FVendor Control Assessments: Conduct third-party\u002Fvendor cybersecurity assessments with a focus on validating control design and operating effectiveness through questionnaires, interviews, and evidence review (e.g., SOC reports, policies\u002Fstandards, procedures, test results) and documenting test conclusions and residual risk. SDLC Control Validation: Validate the effectiveness of security controls embedded in the SDLC by testing secure design and threat modeling, code and dependency scanning, build\u002Frelease controls, change management, vulnerability remediation SLAs, and exception handling across on-prem and cloud delivery pipelines. Assessment Documentation & Reporting: Produce high-quality assessment workpapers, test scripts, and written results that clearly describe scope, procedures performed, evidence reviewed, exceptions identified, and final conclusions. Communicate results through formal reporting, including risk ratings, control gaps, and required remediation actions. Remediation Validation (Re-Test): Validate closure of assessment findings by re-testing remediated controls and confirming that corrective actions adequately address identified control deficiencies. Qualifications: Experience: 3-5+ years of experience across risk management, information security, technology risk, IT audit, or IT operations, with demonstrated experience assessing control design and operating effectiveness. Prior audit\u002Fassurance experience is a plus. Hybrid Technical Depth (On-Prem & Cloud): Proven ability to test and validate controls across on-premises infrastructure (networks, servers, endpoints, identity platforms) and cloud environments, including cloud native services and shared-responsibility control models. Third-Party\u002FVendor Assessment Experience: Experience performing third-party cyber risk assessments, including evidence collection and review, control mapping to standards (e.g., NIST, CIS, ISO), risk rating, issue documentation, and remediation tracking. CRI Profile Expertise: Experience performing CRI Profile assessments and\u002For maturity evaluations, including control mapping, evidence validation, and maturity scoring. Documentation & Workpapers: Experience producing clear assessment documentation (workpapers), process\u002Fcontrol narratives, test scripts, and issue statements that support risk ratings and remediation plans. Regulatory & Financial Services Knowledge: Knowledge of relevant banking and privacy regulations and supervisory expectations (e.g., FFIEC, OCC, FRB, Basel, GDPR, etc.), including expectations for technology risk management, cybersecurity governance, and third-party oversight within regulated financial institutions. SDLC \u002F Secure Engineering Controls: Experience validating SDLC control effectiveness (e.g., secure design\u002Fthreat modeling, SAST\u002FDAST, dependency scanning, CI\u002FCD build and release controls, change management, vulnerability remediation, and exceptions\u002Fwaivers). Certifications: Professional certifications such as CISSP, CISM, CRISC, CISA, CGEIT, or cloud security certifications (e.g., CCSK\u002FCCAK or equivalent). Vendor\u002Fthird-party risk or audit\u002Fassurance credentials are a plus. Education: Bachelor’s degree in Information Security, Computer Science, Information Systems, or a closely related discipline (or equivalent related experience). Mitsubishi UFJ Financial Group (MUFG) is an equal opportunity employer. We view our employees as our key assets as they are fundamental to our long-term growth and success. MUFG is committed to hiring based on merit and organsational fit, regardless of race, religion or gender. At MUFG, our colleagues are our greatest assets. Our Culture Principles provide a roadmap for how each of our colleagues must think and act to become more client-obsessed, inclusive and innovative. They reflect who we are, who we want to be and what we expect from one another. We are excited to see you take the next step in exploring a career with us and encourage you to spend more time reviewing them! Our Culture Principles Client Centric People Focused Listen Up. Speak Up. Innovate & Simplify Own & Execute",{"@type":19,"name":9},"Organization","2026-07-27","ONSITE",[23],"PERMANENT",[25],"Financial Services",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56],"Cloud Security","Vulnerability Management","SDLC Security","Identity and Access Management","Network Security","Data Protection","Logging and Monitoring","Configuration Management","Change Management","Threat Modeling","SAST\u002FDAST","Dependency Scanning","CI\u002FCD Security","Communication","Collaboration","Analytical Thinking","Attention to Detail","Problem Solving","Documentation Skills","Independence","Teamwork","Control Testing","Risk Assessment","Third-Party Risk Management","CRI Profile Assessment","Regulatory Compliance","IT Audit","Security Governance","Vendor Assessment","Remediation Validation",{"@type":58,"currency":59,"value":60},"MonetaryAmount","EUR",{"@type":61,"minValue":62,"maxValue":63,"unitText":64},"QuantitativeValue",80000,110000,"YEAR","2027-07-27",[67],13.0847623,[69],77.6402877,"permanent",[72],"FULL_TIME",[72],"onsite",2000000,3500000,"INR","estimated",[80,81,82],"Career development","Inclusive culture","Equal opportunity employer",[80,81,82],"financial services",[86],"mufg, bcit bengaluru office (mgs), india",[88],"Block No.2 North Wing of the 4th floor at BCIT, Off, Thanisandra Main Rd, Chokkanahalli, Bengaluru, Karnataka 560064, Indien",[90],"Thanisandra Main Road Off",[92],"Bengaluru",[94],"560064",[96],"Indien",[98],"IN","Do you want your voice heard and your actions to count? Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world. With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career. Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.\n\n## Job Summary\n\nThis role is a member of the CISO of America’s team within the Cybersecurity GRC function and is responsible for executing independent control testing, control assessments, and validation activities across both on-premises and cloud environments. The role performs CRI Profile maturity assessments, validates key security controls embedded within the SDLC (e.g., secure design, secure configuration, vulnerability management, and change\u002Frelease controls), and evaluates evidence to confirm control design and operating effectiveness. The role also conducts third-party\u002Fvendor cybersecurity assessments with a focus on control validation and documented test results.\n\n## Roles and Responsibilities\n\n### Primary Responsibilities\n\n- **Assessment Planning & Scoping:** Plan and execute control testing engagements by defining scope, test approach, sampling, and evidence requirements for on-premises and cloud-based control environments.\n- **Control Testing & Validation (On-Prem & Cloud):** Test control design and operating effectiveness using evidence-based procedures (e.g., walkthroughs, inquiry, inspection, observation, and re-performance) across identity, network, endpoint\u002Fserver, data protection, logging\u002Fmonitoring, vulnerability management, and configuration\u002Fchange management for both on-premises and cloud platforms.\n- **CRI Profile Maturity Assessments:** Perform CRI Profile maturity assessments by mapping controls to CRI requirements, evaluating evidence, determining maturity ratings, and documenting gaps and improvement opportunities.\n- **Third-Party\u002FVendor Control Assessments:** Conduct third-party\u002Fvendor cybersecurity assessments with a focus on validating control design and operating effectiveness through questionnaires, interviews, and evidence review (e.g., SOC reports, policies\u002Fstandards, procedures, test results) and documenting test conclusions and residual risk.\n- **SDLC Control Validation:** Validate the effectiveness of security controls embedded in the SDLC by testing secure design and threat modeling, code and dependency scanning, build\u002Frelease controls, change management, vulnerability remediation SLAs, and exception handling across on-prem and cloud delivery pipelines.\n- **Assessment Documentation & Reporting:** Produce high-quality assessment workpapers, test scripts, and written results that clearly describe scope, procedures performed, evidence reviewed, exceptions identified, and final conclusions. Communicate results through formal reporting, including risk ratings, control gaps, and required remediation actions.\n- **Remediation Validation (Re-Test):** Validate closure of assessment findings by re-testing remediated controls and confirming that corrective actions adequately address identified control deficiencies.\n\n## Qualifications\n\n### Experience\n\n- 3-5+ years of experience across risk management, information security, technology risk, IT audit, or IT operations, with demonstrated experience assessing control design and operating effectiveness. Prior audit\u002Fassurance experience is a plus.\n- **Hybrid Technical Depth (On-Prem & Cloud):** Proven ability to test and validate controls across on-premises infrastructure (networks, servers, endpoints, identity platforms) and cloud environments, including cloud native services and shared-responsibility control models.\n- **Third-Party\u002FVendor Assessment Experience:** Experience performing third-party cyber risk assessments, including evidence collection and review, control mapping to standards (e.g., NIST, CIS, ISO), risk rating, issue documentation, and remediation tracking.\n- **CRI Profile Expertise:** Experience performing CRI Profile assessments and\u002For maturity evaluations, including control mapping, evidence validation, and maturity scoring.\n- **Documentation & Workpapers:** Experience producing clear assessment documentation (workpapers), process\u002Fcontrol narratives, test scripts, and issue statements that support risk ratings and remediation plans.\n- **Regulatory & Financial Services Knowledge:** Knowledge of relevant banking and privacy regulations and supervisory expectations (e.g., FFIEC, OCC, FRB, Basel, GDPR, etc.), including expectations for technology risk management, cybersecurity governance, and third-party oversight within regulated financial institutions.\n- **SDLC \u002F Secure Engineering Controls:** Experience validating SDLC control effectiveness (e.g., secure design\u002Fthreat modeling, SAST\u002FDAST, dependency scanning, CI\u002FCD build and release controls, change management, vulnerability remediation, and exceptions\u002Fwaivers).\n\n### Certifications\n\nProfessional certifications such as CISSP, CISM, CRISC, CISA, CGEIT, or cloud security certifications (e.g., CCSK\u002FCCAK or equivalent). Vendor\u002Fthird-party risk or audit\u002Fassurance credentials are a plus.\n\n### Education\n\nBachelor’s degree in Information Security, Computer Science, Information Systems, or a closely related discipline (or equivalent related experience).\n\nMitsubishi UFJ Financial Group (MUFG) is an equal opportunity employer. We view our employees as our key assets as they are fundamental to our long-term growth and success. MUFG is committed to hiring based on merit and organsational fit, regardless of race, religion or gender.\n\nAt MUFG, our colleagues are our greatest assets. Our Culture Principles provide a roadmap for how each of our colleagues must think and act to become more client-obsessed, inclusive and innovative. They reflect who we are, who we want to be and what we expect from one another. We are excited to see you take the next step in exploring a career with us and encourage you to spend more time reviewing them!\n\n### Our Culture Principles\n\n- Client Centric\n- People Focused\n- Listen Up. Speak Up.\n- Innovate & Simplify\n- Own & Execute",{"sast\u002Fdast":101,"sdlc security":102,"ci\u002Fcd security":101,"cloud security":102,"data protection":101,"threat modeling":101,"network security":101,"change management":101,"dependency scanning":101,"logging and monitoring":101,"configuration management":101,"vulnerability management":102,"identity and access management":101},3,4,[27,28,29,30,31,32,33,34,35,36,37,38,39],{"communication":102,"collaboration":102,"analytical thinking":102,"attention to detail":102,"problem solving":102,"documentation skills":102,"independence":101,"teamwork":102},[40,41,42,43,44,45,46,47],{"it audit":101,"control testing":102,"risk assessment":102,"vendor assessment":102,"security governance":102,"regulatory compliance":102,"cri profile assessment":102,"remediation validation":102,"third-party risk management":102},[48,49,50,51,52,53,54,55,56],{"detected_language_jobad":109,"required":110},"en",[111],[112],{"language":113,"level":114},"ENGLISH","C2",5,[117,118],"Information and Communications Technology Professionals","Finance Professionals",[117,118],"https:\u002F\u002Fmufgub.wd3.myworkdayjobs.com\u002Fen-us\u002Fmufg-careers\u002Fjob\u002Fmufg-global-service-private-ltd---bengaluru-bcit\u002Fcybersecurity-control-testing---cri-maturity-assessor---avp_10077187-wd-1",1]