Continuous Controls Monitoring (CCM) Engineer / Architect / Business Analyst

Hiring Continuous Controls Monitoring (CCM) Engineer / Architect / Business Analyst

Locations: Plano, TX; Charlotte, NC; or Malvern, PA

Work Arrangement: Hybrid-onsite 3 days per week

Employment Type: W2

Relocation: Candidates willing to relocate are welcome

Must have 10+ yrs of experience

Pay :$50-55/hr DOE on W2

Any Visa except H1B

Role Overview

Client is seeking an experienced Business Analyst contractor to support the design, build, and production launch of an in-house Continuous Controls Monitoring (CCM) capability within Enterprise Security & Fraud (ES&F).

This is not a generalist Business Analyst role. Candidates must have hands-on experience designing, building, or implementing a CCM solution and be able to apply proven delivery approaches and practical lessons learned from day one.

The contractor will collaborate with cybersecurity control owners, engineering teams, data providers, and risk stakeholders to identify controls suitable for automation, translate control objectives into executable monitoring routines, validate outputs, and drive delivery through production go-live and operational adoption.

Key Responsibilities

• Identify and Prioritize CCM Use Cases
• Partner with ES&F control owners and subject-matter experts to identify cybersecurity controls suitable for continuous monitoring and automation.
• Assess controls based on risk significance, maturity, repeatability, data availability, monitoring feasibility, and expected assurance value.
• Facilitate discussions to define control objectives, monitoring intent, desired outcomes, and measurable success criteria.
• Define Requirements and Monitoring Logic
• Elicit and document business, functional, data, and non-functional requirements for each CCM use case.
• Translate control objectives and operating procedures into measurable rules, thresholds, exception criteria, monitoring logic, and expected outputs.
• Define data sources, required attributes, population and coverage expectations, refresh frequency, dependencies, data-quality checks, and evidence requirements.
• Document user stories, process flows, acceptance criteria, reporting needs, escalation paths, and remediation workflows.
• Maintain requirements traceability from control objectives through monitoring logic, technical implementation, testing, and production outcomes.
• Partner with Engineering to Build Monitoring Routines
• Serve as the day-to-day liaison among control owners, cybersecurity teams, engineers, data providers, and risk stakeholders.
• Work with engineers to convert requirements into scalable monitoring routines using security telemetry and enterprise data.
• Review prototypes and interim outputs with stakeholders to confirm that monitoring routines accurately measure intended control outcomes.
• Drive timely decisions and resolve ambiguity that could delay implementation.
• Validate Outcomes and Drive Go-Live
• Coordinate end-to-end testing, including data validation, logic validation, User Acceptance Testing (UAT), and reconciliation against existing control evidence where appropriate.
• Confirm that monitoring outputs are accurate, explainable, actionable, and aligned with acceptance criteria.
• Drive resolution of defects, false positives, data gaps, coverage limitations, and implementation issues before production release.
• Lead go-live readiness discussions covering ownership, support, reporting, exception management, escalation, remediation, and operating procedures.
• Support the transition to business-as-usual operations and capture lessons learned and improvement opportunities.
• Lead Stakeholder Engagement and Delivery Governance
• Plan and facilitate workshops and decision forums with technical and non-technical stakeholders.
• Maintain delivery plans, RAID logs, decision records, dependencies, and status reports across the CCM workstream.
• Communicate progress, risks, recommendations, and decisions clearly to senior stakeholders and governance forums.
• Build alignment across teams with competing priorities and drive shared accountability for successful outcomes.
  
  

Required Qualifications

• CCM Domain Expertise: Demonstrable hands-on experience designing, building, or implementing an in-house CCM solution or comparable automated control-monitoring capability.
• End-to-End Delivery: Proven experience taking cybersecurity control-monitoring use cases from identification and requirements through engineering, testing, and production go-live.
• Cybersecurity Control Knowledge: Strong understanding of cybersecurity controls, control objectives, operating effectiveness, automated evidence, and exception-based monitoring.
• Requirements and Rule Definition: Experience translating control language into measurable rules, data requirements, monitoring logic, and acceptance criteria.
• Cross-Functional Collaboration: Experience working directly with control owners, cybersecurity engineers, data teams, and technology stakeholders.
• Business Analysis: Strong skills in requirements elicitation, process mapping, workshop facilitation, user stories, acceptance criteria, and traceability.
• Delivery and Issue Resolution: Ability to manage ambiguity, resolve cross-functional issues, and drive complex delivery discussions to closure.
• Communication: Excellent written, verbal, and executive communication skills.
  
  

Preferred Qualifications

• Security Telemetry and Data: Hands-on experience with data across domains such as Identity and Access Management (IAM), Vulnerability Management, Endpoint Security, Cloud Security, Configuration Management, and Asset Inventory.
• Tools and Platforms: Experience with CCM, Governance, Risk and Compliance (GRC), risk analytics, or control-automation platforms, including commercial and custom in-house solutions.
• Control Frameworks: Knowledge of NIST CSF, CIS Controls, ISO 27001, COBIT, or other relevant frameworks.
• Agile Delivery: Experience supporting backlog management, sprint ceremonies, and UAT in an Agile environment.
• Certifications: Relevant certifications such as CISSP, CISA, CRISC, CGRC, or CBAP.
  
  

Expected Engagement Outcomes

• A prioritized set of ES&F cybersecurity controls suitable for continuous monitoring and automation.
• Complete, traceable requirements and monitoring specifications for agreed CCM use cases.
• Validated monitoring routines producing accurate, explainable, and actionable control outcomes.
• Defined ownership, reporting, exception management, escalation, and operational-support processes.
• Successful production go-live and transition into sustainable operations.
• Reusable delivery methods, templates, and lessons learned to strengthen the ES&F CCM capability.