Information Technology Auditor

About This Role

This role supports ISO/IEC 27001 engagements from planning through deliverables, focusing on evaluating ISMS requirements, assessing control implementation, analyzing evidence, documenting results, and contributing to clear, high-quality reporting. It is a strong fit for someone who enjoys technical environments, can communicate clearly, and wants to build deep expertise in ISO 27001 auditing, ISMS governance, and risk-based security programs.

Responsibilities

• Plan and execute ISO/IEC 27001 engagements, including audit plans, request lists, interview schedules, and testing approaches
• Conduct ISMS walkthroughs and stakeholder interviews (security, IT, engineering, compliance, leadership), documenting in a clear, audit-ready format
• Assess ISMS scope, boundaries, context (Clause 4), leadership and governance (Clause 5), planning and risk management (Clause 6), support and documentation (Clause 7), and operational controls (Clause 8)
• Evaluate performance evaluation and improvement processes (Clauses 9–10), including internal audit, management review, metrics, corrective actions, and continual improvement
• Review and validate core ISO 27001 artifacts such as the risk assessment methodology, risk treatment plan, Statement of Applicability, policies, procedures, and documented controls
• Test control design and operating effectiveness across relevant Annex A control areas (identity and access, cryptography, secure development, change management, logging and monitoring, incident management, supplier security, asset management, physical security, etc.)
• Execute risk-based sampling and evidence evaluation, including completeness and accuracy considerations for system-generated evidence
• Analyze technical configurations and logs (where applicable), and translate technical details into clear, objective audit documentation
• Draft and refine workpapers that support conclusions, including narratives, test steps, results, and nonconformities or observations where applicable
• Contribute to engagement outputs, including clear findings, impact statements, and support for corrective action planning when needed
• Support internal quality reviews, responding to reviewer notes and improving documentation until it is publication-ready
• Identify scoping risks early (outsourced processes, shared responsibility boundaries, supplier dependencies, unclear scope statements) and escalate appropriately
• Help build the ISO 27001 practice by improving templates, checklists, evidence standards, and repeatable audit workflows

Requirements

• Strong skills in IT audit and information security controls assessment and validation
• Practical understanding of how security governance and controls operate in modern environments (cloud, SaaS, CI/CD, identity, logging, vendor ecosystems)