IT Security Audit Specialist

Farmers Mutual Hail Insurance Company•West Des Moines, IA

About The Position

Farmers Mutual Hail (FMH) is seeking an IT Security Audit Specialist to support the organization’s compliance and annual assessment activities, including audit readiness, evidence validation, control testing, and documentation. The specialist will support ongoing security audits and control assessments to identify gaps, validate remediation, and maintain continuous compliance readiness. The role conducts risk-based assessments of technical and administrative security controls, reviews key security domains, documents findings and deficiencies, evaluates risk, and coordinates corrective actions with control owners. It also maintains audit and control documentation and provides guidance to technical and business stakeholders on security, compliance, documentation, and evidence requirements. This position is not eligible for work authorization sponsorship by Farmers Mutual Hail Insurance Company, SI. Candidates who require sponsorship now or in the future cannot be considered.

Requirements

At least 3 to 7 years of experience in cybersecurity, IT audit, security compliance, technology risk, information technology, or a related field.
Associate’s Degree in Cybersecurity, Information Technology, Computer Science, MIS, Information Assurance, Risk Management, or a related field.
Bachelor’s Degree preferred.
The position is not eligible for work authorization sponsorship; applicants requiring sponsorship now or in the future cannot be considered.

Nice To Haves

Experience with cybersecurity frameworks, security control assessments, audit evidence collection, technical documentation, or internal/external audit support.
Experience working with NIST SP 800-171, NIST SP 800-53, or similar control-based cybersecurity frameworks.
Relevant cybersecurity, audit, or compliance certifications, including CompTIA Security+, ISACA CISA, ISACA CRISC, ISC2 Certified in Cybersecurity (CC), GIAC GSEC, or other applicable security, audit, risk, or compliance certifications.

Responsibilities

Coordinate and support annual assessment activities and year-round compliance readiness.
Plan assessments; collect and validate evidence; conduct control reviews; respond to assessor requests; coordinate stakeholders; and identify control or evidence gaps.
Perform risk-based assessments of technical and administrative security controls to validate that controls are appropriately designed, implemented, documented, and operating as intended.
Review identity and access management, endpoint security, vulnerability and patch management, logging and monitoring, and configuration management.
Document assessment findings and control deficiencies.
Evaluate associated risk and coordinate corrective actions with control owners.
Maintain audit evidence, workpapers, control documentation, findings, remediation records, policies, standards, and procedures.
Perform ongoing security audits and control reviews outside the annual assessment cycle, monitoring recurring findings and control trends.
Recommend improvements to security controls and audit processes.
Provide guidance to technical and business stakeholders regarding security, compliance, documentation, and evidence requirements.