Business Analyst – Continuous Controls Monitoring (CCM)

Location: Malvern, PA or Charlotte, NC
Work Model: Hybrid – 3 days onsite per week

Position Overview

We are seeking an experienced Business Analyst to support the design, development, and implementation of a Continuous Controls Monitoring (CCM) solution. This individual will work closely with cybersecurity, technology, risk, and engineering teams to develop a custom, in-house monitoring capability that automates the validation of key controls and provides ongoing visibility into control effectiveness.

The ideal candidate will have hands-on experience taking CCM initiatives from initial requirements and use-case development through solution design, build, validation, and production deployment. Experience within financial services is strongly preferred.

Key Responsibilities

• Lead requirements gathering and define use cases for a custom, in-house Continuous Controls Monitoring solution.

• Partner with cybersecurity control owners, risk stakeholders, data teams, and engineers to identify opportunities to automate control monitoring.

• Translate control objectives into measurable monitoring logic, rules, thresholds, data requirements, and acceptance criteria.

• Define data sources, integration requirements, monitoring frequency, and validation processes.

• Work alongside technical teams throughout solution design, development, testing, and implementation.

• Coordinate validation and user acceptance testing (UAT), ensuring monitoring logic and outputs accurately reflect control requirements.

• Identify data gaps, exceptions, defects, and process issues, driving them through resolution.

• Support production deployment, operational readiness, and transition into ongoing monitoring.

• Develop process documentation, requirements, workflows, and reporting to support transparency and long-term adoption.

Required Qualifications

• Demonstrated hands-on experience designing, building, or implementing a Continuous Controls Monitoring (CCM) solution.

• Experience taking CCM use cases from requirements through development, validation, and production deployment.

• Strong business analysis experience, including requirements gathering, process mapping, user stories, and acceptance criteria.

• Understanding of cybersecurity controls and the ability to translate control objectives into automated monitoring requirements.

• Experience partnering with technical and engineering teams on solution implementation.

• Knowledge of data requirements, data integration, monitoring logic, and control validation.

• Strong communication and stakeholder management skills.

Preferred Qualifications

• Experience within financial services, banking, or investment management.

• Experience developing a custom or internally built CCM solution rather than simply operating an existing monitoring platform.

• Familiarity with cybersecurity frameworks such as NIST, CIS Controls, ISO 27001, or COBIT.

• Exposure to GRC platforms, control automation, security telemetry, ETL, or data integration.

• Experience with controls related to identity and access management, vulnerability management, cloud security, or endpoint security.