Assess control design and operating effectiveness across access management, change management, IT operations, cloud, network and endpoint security, secure development, incident management, resilience and supplier management. Working knowledge of third-party integrations and API risks, including ownership, inventory, authentication, authorisation, data exchange, secrets management, logging, monitoring and lifecycle governance.