Designs and implements security controls, conducts risk assessments, and supports audits, requiring cybersecurity expertise.