Cybersecurity Control Testing & CRI Maturity Assessor - AVP

Do you want your voice heard and your actions to count? Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world. With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career. Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.  Job Summary: This role is a member of the CISO of America’s team within the Cybersecurity GRC function and is responsible for executing independent control testing, control assessments, and validation activities across both on-premises and cloud environments. The role performs CRI Profile maturity assessments, validates key security controls embedded within the SDLC (e.g., secure design, secure configuration, vulnerability management, and change/release controls), and evaluates evidence to confirm control design and operating effectiveness. The role also conducts third-party/vendor cybersecurity assessments with a focus on control validation and documented test results. Roles and Responsibilities Primary Responsibilities: Assessment Planning & Scoping: Plan and execute control testing engagements by defining scope, test approach, sampling, and evidence requirements for on-premises and cloud-based control environments. Control Testing & Validation (On-Prem & Cloud): Test control design and operating effectiveness using evidence-based procedures (e.g., walkthroughs, inquiry, inspection, observation, and re-performance) across identity, network, endpoint/server, data protection, logging/monitoring, vulnerability management, and configuration/change management for both on-premises and cloud platforms. CRI Profile Maturity Assessments: Perform CRI Profile maturity assessments by mapping controls to CRI requirements, evaluating evidence, determining maturity ratings, and documenting gaps and improvement opportunities. Third-Party/Vendor Control Assessments: Conduct third-party/vendor cybersecurity assessments with a focus on validating control design and operating effectiveness through questionnaires, interviews, and evidence review (e.g., SOC reports, policies/standards, procedures, test results) and documenting test conclusions and residual risk.