IT Auditor Staff, Corporate Technology & Cybersecurity - Hyrbid

First American•Santa Ana, CA

3d•Hybrid

About The Position

The IT Auditor Staff executes assigned testing for Corporate Technology and Cybersecurity operational audits. The role evaluates controls and supporting evidence, documents clear and supportable results, and raises exceptions and emerging risks to the Senior IT Auditor or Manager. The auditor participates in walkthroughs and client discussions, supports issue development and reporting, and maintains audit files in line with Internal Audit quality standards. The position tests controls across operational cybersecurity and data-risk areas, which may include identity and privileged access management, Active Directory, network security and firewalls, cloud security architecture and WAF, security operations and incident response, SIEM/XDR/SOAR, vulnerability management and cyber threat intelligence, data protection and privacy, encryption and key management, application security, and Secure SDLC. For cloud audits, the auditor consults relevant provider security guidance alongside company policies, standards, and audit criteria. The role is hybrid. The stated annual pay range is $73,900–$98,500. Benefits are offered based on eligibility.

Requirements

At least 3 years of relevant experience in IT audit, cybersecurity audit, technology risk, or related control testing, including at least 2 years directly performing IT or cybersecurity operational audits.
Hands-on operational audit testing in at least one target profile: IAM/PAM, including CyberArk, Active Directory, or firewall/network controls; or cloud security/WAF, SIEM/XDR/SOAR, DLP, encryption/key management, or vulnerability evidence. Experience limited to general ITGC testing is insufficient.
Working knowledge of risk-based audit testing, evidence evaluation, sampling, workpaper documentation, and communicating exceptions.
Familiarity with official security guidance for Microsoft Azure, AWS, and Google Cloud, including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance, and ability to apply relevant guidance during audit testing.
Ability to manage assigned testing, meet deadlines, and raise questions or concerns promptly.
Strong analytical, written, and verbal communication skills, including the ability to explain evidence needs to technical and nontechnical stakeholders.

Nice To Haves

Experience testing controls in multiple technology or cybersecurity audit areas, especially Vulnerability Management, Network Security, Security Operations, Data Protection, Offensive Security, Application Security, Cloud Service Management, or Secure SDLC.
Banking or financial-services experience.
Exposure to GLBA, Interagency Guidelines, SWIFT CSP, PCI DSS, OWASP, CIS Benchmarks, NIST CSF, or NIST SP 800-series guidance.
Hands-on exposure to cloud environments or cloud security controls.
CISA or another relevant certification, or active progress toward one.
Relevant IT or cybersecurity coursework, professional training, or hands-on experience.
Familiarity with AuditBoard, Power BI, ServiceNow, Jira, or SailPoint.

Responsibilities

Perform assigned audit procedures, including walkthroughs, control assessments, population validation, sample selection, evidence inspection, reperformance, and follow-up testing.
Test operational cybersecurity and data-risk controls across assigned areas, such as IAM/PAM, Active Directory, network security, firewalls, cloud security, WAF, security operations, incident response, SIEM/XDR/SOAR, vulnerability management, CTI, data protection, privacy, DLP, encryption, key management, application security, and Secure SDLC.
Inspect and test technical and architecture evidence, including configurations, access records, scan results, change records, logs, encryption, certificates, and documented exceptions in the assigned specialty.
For cloud audits, consult relevant cloud-provider security guidance and consider recommendations on network security, access, segmentation, logging, and secure connectivity alongside company policies, standards, and audit criteria.
Evaluate evidence for completeness, reliability, relevance to the control, and consistency with the control objective; identify gaps or contradictions and raise them promptly.
Document procedures, evidence reviewed, sample details, results, exceptions, and conclusions in organized, traceable workpapers.
Participate in walkthroughs and client discussions, explain evidence requests and testing questions, and follow up on outstanding items.
Analyze exceptions and support assessment of their cause, impact, extent, and potential compensating controls.
Support issue development, report preparation, issue validation, and examination support materials.
Use audit tools and data-analysis techniques where appropriate to validate populations, identify anomalies, or improve testing coverage.
Incorporate review comments and maintain audit files in accordance with Internal Audit quality standards.
Manage assigned testing, meet deadlines, and raise questions or concerns promptly.