Continuous Controls Monitoring (CCM) Engineer

Title: CCM Engineer

Location: Plano TX, Charlotte, NC, Malvern PA/Hybrid

Duration: 6-12 Months

Visa: No H1b

The contractor to support the design, build and go-live of an in-house Continuous Controls Monitoring (CCM) capability within Enterprise Security & Fraud (ES&F).

This is not a generalist business analyst role. The successful candidate must have prior hands-on experience designing, building or implementing a CCM solution and be able to apply proven delivery approaches and practical lessons learned from day one.

The contractor will work across cybersecurity control owners, engineering teams, data providers and risk stakeholders to identify controls suitable for automation, translate control objectives into exercutable monitoring routinesa, validate outputs, and drive end-to-end discussions through successful production go-live and operational adoption.

1. Identify and Prioritize CCM Use Cases

Partner with ES&F control owners and subject-matter experts to identify cybersecurity controls suitable for continuous monitoring and automation.

Assess candidate controls based on risk significance, control maturity, repeatability, data availability, monitoring feasibility and expected assurance value.

Facilitate structured discussions to define the control objective, monitoring intent, desired outcome and measurable success criteria.

2. Define Requirements and Monitoring Logic

Elicit and document business, functional, data and non-functional requirements for each CCM use case.

Work with control owners to translate control objectives and operating procedures into measurable logic, rules, thresholds, exception criteria and expected outputs.

Define data sources, required attributes, population and coverage expectations, refresh frequency, dependencies, data-quality checks and evidence requirements.

Document user stories, process flows, acceptance criteria, reporting needs, escalation paths and remediation workflows.

Maintain requirements traceability from the underlying control objective through monitoring logic, technical implementation, test results and production outcome.

3. Partner with Engineering to Build Monitoring Routines

Act as the day-to-day bridge between control owners, cybersecurity teams, engineering teams, data providers and risk stakeholders.

Work closely with engineers to convert agreed requirements into scalable monitoring routines using available security telemetry and enterprise data.

Review prototypes and interim outputs with stakeholders to confirm that the routine accurately measures the intended control outcome.

Drive timely decisions and remove ambiguity that could delay implementation.

4. Validate Outcomes and Drive Go-Live

Coordinate end-to-end testing, including data validation, logic validation, user acceptance testing and reconciliation against existing control evidence where appropriate.

Confirm that monitoring outputs are accurate, explainable, actionable and aligned to agreed acceptance criteria.

Drive resolution of defects, false positives, data gaps, coverage limitations and implementation issues before production release.

Lead go-live readiness discussions covering ownership, support, reporting, exception management, escalation, remediation and operating procedures.

Support the transition into business-as-usual operations and capture lessons learned and improvement opportunities after launch.

5. Stakeholder Leadership and Delivery Governance

Plan and facilitate end-to-end workshops and decision forums with technical and non-technical stakeholders.

Maintain clear delivery plans, RAID logs, decisions, dependencies, and status reporting across the CCM workstream.

Communicate progress, risks, recommendations and decisions in a concise manner for senior stakeholders and governance forums.

Build alignment across teams with different priorities and drive shared accountability for successful outcomes.

Expected Engagement Outcomes

A prioritized set of ES&F cybersecurity controls suitable for continuous monitoring and automation.

Complete, traceable requirements and monitoring specifications for agreed CCM use cases.

Validated monitoring routines that produce accurate, explainable and actionable control outcomes.

Defined ownership, reporting, exception-management, escalation and operational-support processes.

Successful production go-live and transition of delivered CCM use cases into sustainable operations.

Reusable delivery methods, templates and lessons learned that strengthen the ES&F CCM capability.

Must Have

• CCM Domain Expertise: Demonstrable hands-on experience designing, building, or implementing an in-house Continuous Controls Monitoring (CCM) solution or comparable automated control-monitoring capability.
• End-to-End Delivery: Proven experience taking cybersecurity control-monitoring use cases from identification and requirements through engineering build, testing, and production go-live.
• Cybersecurity Control Knowledge: Strong understanding of cybersecurity controls, control objectives, operating effectiveness, automated evidence, and exception-based monitoring.
• Requirements & Rule Definition: Experience translating control language into measurable rules, data requirements, monitoring logic, and acceptance criteria.
• Cross-Functional Collaboration: Experience working directly with control owners, cybersecurity engineers, data teams, and technology stakeholders.
• Core Business Analysis Skills: Strong BA capability including requirements elicitation, process mapping, workshop facilitation, user stories, acceptance criteria, and traceability.
• Delivery & Issue Resolution: Demonstrated ability to manage ambiguity, resolve cross-functional issues, and drive complex delivery discussions to closure.
• Communication: Excellent written, verbal, and executive communication skills.

Preferred

• Security Telemetry & Data: Hands-on experience with telemetry/data across key domains (e.g., IAM, Vulnerability Management, Endpoint Security, Cloud Security, Configuration Management, Asset Inventory).
• Tooling & Platforms: Experience with CCM, GRC, risk analytics, or control-automation platforms (commercial or custom in-house).
• Control Frameworks: Knowledge of relevant cybersecurity and control frameworks (e.g., NIST CSF, CIS Controls, ISO 27001, COBIT).
• Agile Methodology: Experience working in an Agile delivery environment supporting backlog management, sprint ceremonies, and User Acceptance Testing (UAT).
• Certifications: Relevant industry certifications (e.g., CISSP, CISA, CRISC, CGRC, CBAP).

Thanks & Regards.

Aviral Sapra

Voto Consulting LLC

Direct #: