Staff IT Auditor
Core
Leads second-line assurance for IT control landscape, advising first-line on operationalization and managing continuous testing of IT General Controls (ITGC) and Risk and Control Matrix (RCM) lifecycle.
Role type
Staff IT Auditor (Second Line of Defense)
Builds
Integrated IT control design, risk registers, and assurance processes for security frameworks.
Domain
Information Security, IT Governance, Risk, and Compliance (GRC)
Required skills
IT General Controls (ITGC) testing, Risk and Control Matrix (RCM) management, NIST CSF 2.0, NIST AI RMF, NIST 800-53, ISO/IEC 27001/27018, AICPA Trust Services Criteria (SOC 2), COSO, COBIT, FedRAMP Moderate/High, control rationalization, gap analysis, risk treatment planning, executive reporting, stakeholder collaboration, complex problem solving, strategic intent translation.
Preferred skills
Advanced or terminal GRC certifications (CISA, CISSP, CGEIT), experience with FedRAMP authorization packages, experience with SOX readiness initiatives, experience with third-party auditor (3PAO) reviews.
Technologies
NIST CSF 2.0, NIST AI RMF, NIST 800-53, ISO/IEC 27001, SOC 2, COSO, COBIT, FedRAMP
Responsibilities
Develop, manage, and optimize second-line assurance activities; set and maintain information security policies and standards; identify and report risks with high-fidelity reasoning; provide expertise on control requirements; monitor control performance and design optimization plans; own the process for tracking and reporting control deficiencies; update and report on the information security risk register; define and report risk metrics to leadership; serve as subject matter expert on IT controls; collaborate with ERM to set IT risk appetite; set IT control architectural standards; partner to engineer processes embedding controls; account for enterprise-wide audit consequences; collaborate on certification strategy; maintain fluency in security standards and frameworks; collaborate with third line of defense for integrated audits; perform independent analysis of security maturation; lead diagnosis of complex control failures; represent security in high-stakes forums; support SOX readiness and integrated audits; lead pre-assessment reviews of FedRAMP authorization packages.
Seniority
Staff, hands-on IC with strategic influence
