Internal IT Auditor

The Internal IT Auditor is a hands-on technical role focused on evaluating, monitoring, and auditing the organization's technical systems, infrastructure, and core operating applications. This position ensures that engineering configurations and technical architecture satisfy the requirements of our Information Security Management System (ISMS), ISO/IEC 27001/2022, and PCI DSS v4.0. Operating as an Internal Security Assessor (ISA), this individual bridges the gap between pure policy and technical implementation, verifying system controls at the root level before formal external validation.

Key Responsibilities

Technical ISMS & System Auditing: Audit system configurations, cloud architectures (OCI/AWS/Azure), operating systems, and network parameters to ensure continuous alignment with ISO 27001/2022 and internal security manuals (ISMs).

PCI DSS Internal Assessment (ISA Role): Perform routine internal audits of the

Cardholder Data Environment (CDE). Maintain data flow and network segmentation diagrams, review daily security logs, and validate network boundaries as a certified or equivalent Internal Security Assessor (ISA).

Control Testing & Technical Validation: Go beyond paperwork to verify active technical controls: audit Multi-Factor Authentication (MFA) enforcement, Role

Based Access Control (RBAC) consistency, vulnerability patch cycles, and endpoint protection rules.

Biometric & Identity Access Audit: Evaluate specialized identity verification controls—including biometric hardware and enrollment software workflows (leveraging ISO/IEC 20027 guidelines where applicable —to confirm highly secure physical and logical entry points.

Cross-Framework Mapping: Maintain a unified technical control crosswalk to eliminate duplicate audit tasks by mapping system security configurations simultaneously to PCI DSS controls and ISO 27002 clauses.

Evidence Gathering & Log Inspection: Extract and interpret evidence straight from technical systems (e.g., SIEM logs, firewall rulesets, encryption keys, and pipeline vulnerability scans).

Key qualifications:

Bachelor’s degree in IT, Computer Science, Cybersecurity, or an equivalent technical field.

4+ years of demonstrable experience auditing IT systems, verifying infrastructure security, or supporting an active corporate ISMS.

Information Security Certifications are highly valued:

Active or prior PCI ISA or QSA designation.

ISO 27001 Internal Auditor / Lead Auditor.

CompTIA Security+, CISA or CEH.