Internal IT Auditor

Role Overview

The Internal IT Auditor examines the organization’s infrastructure and business-critical applications to determine whether security controls work as intended—not just whether they are documented. You will assess cloud and on-premises configurations against the organization’s ISMS, ISO/IEC 27001:2022 and PCI DSS v4.0, helping teams address control gaps before external reviews.

Key Responsibilities

• Review cloud environments, operating systems, network settings and application configurations against security requirements and internal security manuals.
• Conduct recurring assessments of the Cardholder Data Environment, including examination of security logs, network boundaries and segmentation, and upkeep of data-flow and network diagrams.
• Test whether technical safeguards are operating effectively, including MFA, role-based access, vulnerability remediation schedules and endpoint protection.
• Assess biometric identity systems, from hardware controls to enrollment workflows, using relevant ISO/IEC 20027 guidance where applicable.
• Maintain a technical control crosswalk connecting system configurations with PCI DSS requirements and ISO 27002 controls to streamline overlapping audit work.
• Collect and analyze evidence directly from systems, such as SIEM records, firewall configurations, encryption-key controls and pipeline vulnerability scan results.
• Document findings clearly and work with technical teams to clarify control deficiencies and support remediation.

Requirements & Qualifications

• Bachelor’s degree in information technology, computer science, cybersecurity or a comparable technical discipline; equivalent technical education may be considered.
• At least four years of experience auditing IT systems, assessing infrastructure security or supporting an operational corporate ISMS.
• Practical familiarity with technical control assessment across cloud platforms, operating systems, networks and core applications.
• Understanding of ISO/IEC 27001:2022 and PCI DSS v4.0 requirements, including PCI assessment of a Cardholder Data Environment.
• Experience examining technical evidence such as security logs, access controls, firewall rules and vulnerability scans.
• PCI ISA or QSA designation, current or previous, is highly valued.
• ISO 27001 Internal Auditor or Lead Auditor training, or certifications such as CompTIA Security+, CISA or CEH, are highly valued.