Performs risk assessments of complex IT and cybersecurity environments, including identity and access management, network and endpoint security, cloud security, security operations, vulnerability management, data protection, application security, resilience, general IT controls, automated controls, and underlying infrastructure. Evaluates the design and operating effectiveness of cybersecurity and technology controls using risk-based testing, data analytics, technical evidence, and recognized regulatory and industry frameworks; challenges control owners constructively and translates technical observations into clear business and risk implications.