Internal IT Auditor

Job Summary
The Internal IT Auditor is a hands-on technical role focused on evaluating, monitoring,
and auditing the organization's technical systems, infrastructure, and core operating
applications. This position ensures that engineering configurations and technical
architecture satisfy the requirements of our Information Security Management
System (ISMS), ISO/IEC 27001/2022, and PCI DSS v4.0.
Operating as an Internal Security Assessor (ISA), this individual bridges the gap
between pure policy and technical implementation, verifying system controls at the
root level before formal external validation.

Key Responsibilities
• Technical ISMS & System Auditing: Audit system configurations, cloud
architectures (OCI/AWS/Azure), operating systems, and network parameters to
ensure continuous alignment with ISO 27001/2022 and internal security
manuals (ISMs).
• PCI DSS Internal Assessment (ISA Role): Perform routine internal audits of the
Cardholder Data Environment (CDE). Maintain data flow and network
segmentation diagrams, review daily security logs, and validate network
boundaries as a certified or equivalent Internal Security Assessor (ISA).
• Control Testing & Technical Validation: Go beyond paperwork to verify active
technical controls: audit Multi-Factor Authentication (MFA) enforcement, Role
Based Access Control (RBAC) consistency, vulnerability patch cycles, and
endpoint protection rules.
• Biometric & Identity Access Audit: Evaluate specialized identity verification
controls—including biometric hardware and enrollment software workflows
(leveraging ISO/IEC 20027 guidelines where applicable —to confirm highly
secure physical and logical entry points.
• Cross-Framework Mapping: Maintain a unified technical control crosswalk to
eliminate duplicate audit tasks by mapping system security configurations
simultaneously to PCI DSS controls and ISO 27002 clauses.
• Evidence Gathering & Log Inspection: Extract and interpret evidence straight
from technical systems (e.g., SIEM logs, firewall rulesets, encryption keys, and
pipeline vulnerability scans).

### Requirements
Key qualifications:
• Bachelor’s degree in IT, Computer Science, Cybersecurity, or an equivalent
technical field.
• 4+ years of demonstrable experience auditing IT systems, verifying
infrastructure security, or supporting an active corporate ISMS.
• Information Security Certifications are highly valued:
o Active or prior PCI ISA or QSA designation.
o ISO 27001 Internal Auditor / Lead Auditor.
o CompTIA Security+, CISA or CEH.

### Benefits
Competitive Remuneration