Internal Controller

ORGANISATION INCERT is a center of expertise providing services and solutions based on knowledge and experience acquired in cryptography, Public Key Infrastructure (PKI), eTravel document, biometry and artificial intelligence. Established since 2012, INCERT is a Public Agency owned by the State of Luxembourg and the Luxembourg Chamber of Commerce. INCERT also represents and defends Luxembourg’s national interests at European and international organizations. Further information about INCERT can be found at www.incert.lu. Within the scope of its business activities, INCERT is now recruiting a Internal Controller as a permanent position. YOUR RESPONSIBILITIES Control plan design and management :
• Build, maintain, and continuously improve the company's consolidated internal control plan, covering cybersecurity, trust services, and corporate functions
• Map each control to its source requirement (ISO/IEC 27001 eIDAS, NIS2, GDPR, contractual and client-specific commitments, internal policy) and eliminate duplicate or orphan controls
• Define, for every control: owner, objective, frequency, testing method, sampling approach, evidence requirements, and acceptance criteria
• Maintain the control catalogue and its risk coverage, in coordination with the risk management process, and flag risks with no effective control coverage Control testing and assurance :
• Execute the annual testing calendar: design effectiveness reviews, operating effectiveness testing, sampling, walkthroughs, and evidence collection
• Test cybersecurity controls: access rights and privileged access reviews, logical and physical access, change and release management, vulnerability and patch management, backup and restore testing, logging and monitoring, cryptographic key management, secure development, business continuity and disaster recovery exercises, incident management
• Test trust service controls: certificate lifecycle operations, key ceremonies, HSM and secure zone controls, CP/CPS conformity, archiving and time-stamping Test corporate controls, including:
• Finance: segregation of duties, payment authorisation, expense claims, bank mandates and delegation of authority, supplier onboarding and due diligence, revenue and billing accuracy, asset inventory
• HR: pre-employment screening and background checks, confidentiality and acceptable use commitments, onboarding and offboarding (including timely revocation of access and return of assets), mandatory security and compliance training completion, disciplinary and whistleblowing process integrity
• Legal and privacy: contract and DPA coverage, records of processing, data subject request handling, retention and deletion
• Produce clear, reproducible working papers so that a third party can re-perform any test you have run Findings, remediation and reporting :
• Raise findings with a documented rating, root cause, business impact, and a remediation action agreed with the control owner
• Track corrective and preventive actions to closure, verify remediation, and escalate overdue or repeatedly deferred items
• Produce periodic control dashboards and reporting for the CISO, executive committee, and relevant governance bodies, including KCIs/KRIs, testing coverage, findings ageing, and trend analysis
• Contribute to the ISO/IEC 27001 management review and to the annual internal audit programme Audit, certification and supervisory relations :
• Help to prepare external assessments: ISO/IEC 27001 certification and surveillance audits, QTSP conformity assessment, client and prospect audits, and any additional certification the company pursues
• Act as evidence gatekeeper: assemble, review, and quality-check evidence packs before they reach an auditor
• Support notification and reporting obligations towards the supervisory body and, where applicable, the certification and conformity assessment bodies
• Maintain the audit calendar and reduce audit fatigue by reusing tested evidence across frameworks Third-parties management :
• Assess and monitor controls at critical suppliers and subcontractors: due diligence, contractual security clauses, right-to-audit exercises, review of their certifications and attestations, and monitoring of concentration and exit risk Control culture and continuous improvement :
• Train and coach control owners so that controls are performed correctly and evidenced at source, not reconstructed at testing time
• Automate control testing and evidence collection wherever feasible
• Propose simplifications: fewer, better-designed controls beat a long list of unverifiable one

YOUR PROFILE
Technical skills and

education:
• Degree in audit, risk management, accounting, information systems, engineering, or a related field
• 4+ years in internal control, internal audit, IT audit, risk, or compliance; ideally including exposure to a regulated or certified environment
• Practical working knowledge of ISO/IEC 27001 and ISO/IEC 27005
• Solid understanding of internal control fundamentals: control design, segregation of duties, delegation of authority, three-lines control model, sampling, evidence standards
• Ability to test technical controls credibly
• Strong written English; ability to write a finding that a control owner accepts and an auditor cannot pick apart Highly desirable :
• Exposure to eIDAS / QTSP requirements and the ETSI EN 319 4xx series, or to another PKI / trust service environment
• Familiarity with NIS2, GDPR, and with COSO
• Certifications such as CISA, CIA, CRISC, CISM, CISSP, ISO/IEC 27001 Lead Auditor or Lead Implementer Soft skills
• Be fluent in French and English, ability to write a finding that a control owner accepts and an auditor cannot pick apart.
• Strong attention to detail and adherence to quality and security standards
• Ability to write clear technical documentation and communicate with non-technical stakeholders Please note that a criminal record will be requested as part of the final stage of our hiring process. We look forward to receiving your application and a letter explaining your interest in the position at the following email address: hrlux@incert.lu