{"id":2131291,"url":"https://alion.io/job/cognizant-cyber-security-control-gap-analyst","title":"Cyber security- Control Gap Analyst","company":{"id":85,"name":"Cognizant","domain":"cognizant.com","url":"https://alion.io/company/cognizant","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Cognizant Careers","truth_index":{"grade":"B","score":78,"open_postings":92,"ghost_share":0,"stale_share":0.891,"repost_share":0,"time_to_fill_p50_days":22,"computed_at":"2026-10-13T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":13500,"max_usd":30000,"period":"year","method":"role_seniority_country_cell","sample_n":10},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ISO 27001","optional":false},{"name":"Jira","optional":false},{"name":"Microsoft Excel","optional":false},{"name":"ServiceNow","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-30T00:43:14Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-13T19:52:45Z","board_verified":true,"closed_at":null,"days_open":13,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":13},"description":"#Cyber Security Experts#\nControl Gap Analyst\nExperience: 5 to 12 Years\nSkill Level: SA/M\nLocation: Bangalore only {Re-location fine}\nFunction: Cyber Risk / IT Risk / GRC / Third-Party Risk Management\nRole Type: Individual Contributor\nRole Overview\nWe are looking for an experienced 3PCRM Control Gap Analyst to manage third-party cybersecurity control exceptions, remediation activities, risk treatment, evidence validation, and issue closure. The role will own issues identified through 3PCRM assessments and work closely with Vendor Managers (VMs), technology teams, business stakeholders, Supplier Leads, and risk teams to drive timely remediation and closure.\nKey Responsibilities\n1. Issue Entry & Ownership\nReview the 3PCRM Assessment Letter and accurately enter control exceptions/findings into the designated Issue Management (IM) tool.\nAssume ownership of assigned issues and ensure complete and accurate issue documentation.\nValidate issue details, risk ratings, control gaps, remediation requirements, and due dates.\nMaintain accurate issue records throughout the remediation lifecycle.\n2. Remediation Plan Review & Approval\nReview vendor-proposed remediation plans to determine whether they adequately address identified control gaps and risks.\nChallenge remediation plans where actions are incomplete, unclear, or insufficient.\nCoordinate with the Vendor Manager (VM) to obtain clarification or revised remediation plans.\nCollaborate with VM and relevant Technology and Line of Business stakeholders to obtain required approvals.\nEnsure remediation activities are risk-based, actionable, measurable, and aligned with organizational requirements.\n3. Risk Treatment & Challenge Management\nInitiate and manage risk treatment challenges using the approved IM Challenge Template.\nAssess proposed risk treatment approaches and challenge vendor responses where appropriate.\nDocument rationale, decisions, stakeholder inputs, and required actions within the Issue Management process.\nEnsure risk treatment activities are properly tracked and supported by evidence.\n4. Remediation Follow-Up & Escalation\nMonitor remediation milestones, target dates, and upcoming issue deadlines.\nProactively follow up with Vendor Managers and vendors for remediation progress and supporting evidence.\nEscalate overdue or at-risk remediation activities to the appropriate stakeholders.\nWhere evidence has not been received two weeks prior to the due date, escalate to the Vendor Manager, company stakeholders, and Supplier Lead.\nMaintain appropriate escalation records and stakeholder communications.\n5. Evidence Validation & Issue Closure\nReview remediation evidence submitted by vendors to determine whether it adequately addresses the identified control gap.\nValidate evidence for completeness, relevance, accuracy, and effectiveness.\nDetermine whether the remediation action sufficiently mitigates the identified risk.\nUpdate the Issue Management record with assessment results and supporting documentation.\nWhere remediation is sufficient, seek approval from the 3PCRM IM Lead Consultant for issue closure.\nEnsure closed issues have complete documentation and an appropriate audit trail.\n6. Risk Acceptance Management\nReview vendor Risk Acceptance (RA) requests and evaluate the rationale provided for accepting the identified risk.\nAssess proposed compensating controls and determine whether they adequately mitigate the associated risk.\nCoordinate with relevant stakeholders where additional information or challenge is required.\nWhere acceptable, initiate/log the appropriate Exception Request.\nTrack risk acceptance deadlines and ensure required approvals are obtained.\nMonitor RA expiry dates and initiate extension, remediation, or reassessment activities as appropriate.\n7. Control Exception & Gap Management\nAnalyze cybersecurity control exceptions identified through third-party assessments.\nEnsure control gaps are clearly documented with associated business and cybersecurity risks.\nTrack findings through remediation, risk acceptance, exception, and closure processes.\nIdentify recurring control gaps and contribute to trend analysis and risk reporting.\nSupport continuous improvement of the 3PCRM control exception and remediation process.\nRequired Skills & Experience\n5+ years of experience in Cyber Risk, IT Risk, IT Audit, GRC, Information Security, or Third-Party Risk Management.\nStrong experience in control gap, finding, issue, and remediation management.\nExperience documenting cybersecurity findings, remediation plans, risk treatment activities, and control exceptions.\nExperience reviewing and challenging remediation plans and risk acceptance requests.\nStrong understanding of risk treatment, compensating controls, exception management, and issue lifecycle management.\nExperience validating remediation evidence and determining whether issues can be closed.\nStrong stakeholder management and escalation skills.\nExcellent analytical, documentation, reporting, and communication skills.\nTools & Platforms\nExperience with one or more of the following:\nArcher\nJira\nServiceNow\nIssue Management / GRC platforms\nMicrosoft Excel and reporting tools\nCybersecurity & Risk Knowledge\nWorking knowledge of:\nThird-Party Risk Management (TPRM/3PCRM)\nCybersecurity Risk Management\nIT General Controls (ITGC)\nControl Testing & Assessment\nRisk & Control Frameworks\nIssue and Exception Management\nRisk Acceptance\nCompensating Controls\nRemediation & Corrective Action Management\nAudit and regulatory requirements\nNIST, ISO 27001, CIS Controls, SOC 2, or equivalent cybersecurity standards\nPreferred Qualifications\nCISA, CRISC, CISSP, CISM, ISO 27001, or equivalent certification.\nExperience working with enterprise GRC/Issue Management platforms.\nExperience in vendor/third-party cybersecurity risk environments.\nExperience working with technology, procurement, business, security, and supplier management teams.\nKey Competencies\n3PCRM Control Exception Management\nCyber Risk & IT Risk Management\nControl Gap Analysis\nIssue Management\nRemediation Tracking\nRisk Treatment & Challenge\nRisk Acceptance & Exception Management\nEvidence Validation\nStakeholder & Vendor Management\nEscalation Management\nAudit Readiness\nStrong Analytical & Reporting Skills\nAttention to Detail\nEffective Written & Verbal Communication","description_format":"text","description_chars":6306,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Engineering Services","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-10-09T00:57:46Z"}],"visa":[],"liveness":{"score":53,"band":"ok","label":"Likely open","p_open":1,"p_active":0.591,"p_room":0.9,"age_days":13,"expected_fill_days":22,"reasons":["conf:1","stale_co","velocity","win:mid","comp:brand"],"computed_at":"2026-10-13T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/cognizant-cyber-security-control-gap-analyst","json_url":"https://alion.io/job/cognizant-cyber-security-control-gap-analyst.json","meta":{"generated_at":"2026-10-13T20:04:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30884,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":85},"rest":"https://alion.io/mcp/rest/get_company?id=85"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcognizant-cyber-security-control-gap-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcognizant-cyber-security-control-gap-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcognizant-cyber-security-control-gap-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cognizant-cyber-security-control-gap-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcognizant-cyber-security-control-gap-analyst"}]}