Senior Information Security Internal Auditor

OneTrust • Atlanta, GA

8h • Hybrid

About The Position

OneTrust is seeking an experienced internal auditor and ISO management-systems subject matter expert to lead audit readiness and continuous improvement across its Integrated Management System (IMS). The role requires hands-on expertise in ISO 9001, ISO/IEC 27001, ISO/IEC 42001, and related standards covering privacy, cloud security, and business continuity. It provides governance for the Quality Management System (QMS), Privacy Information Management System (PIMS), AI Management System (AIMS), and broader IMS.

The position partners with teams across the business to make controls practical, auditable, and consistently operated. It leads the IMS committee, prepares teams for internal and external audits, and represents the organization with sound judgment. The role requires someone organized, self-directed, and persistent in tracking findings through evidence, ownership, deadlines, and verified resolution.

The successful candidate will own internal audit planning and execution, QMS governance, management-system policies and documentation, audit and certification coordination, and corrective-action processes. They will work closely with technical and business stakeholders to translate standards into testable requirements, support evidence collection, improve controls, and report on audit readiness and management-system performance. The organization aims to maintain integrated, credible management systems that reflect how its SaaS business operates while meeting applicable requirements.

OneTrust describes its culture as office-first, encouraging three days per week in the office for most roles. Specific arrangements may vary by role. The role may also be eligible for discretionary bonuses, equity, and/or commissions. Listed pay information applies to candidates based in California, Colorado, Connecticut, Nevada, New York, Rhode Island, and Washington.

Requirements

• Extensive hands-on experience managing or auditing ISO-based management systems in a technology or SaaS organization.
• Deep working knowledge of ISO 9001 and ISO/IEC 27001, with meaningful experience implementing, operating, or auditing ISO/IEC 42001 and AI management systems.
• Experience governing a QMS, including management review, quality objectives, process ownership, documented information, nonconformity handling, and corrective action.
• Experience with PIMS, AIMS, and integrating multiple standards into a coherent IMS.
• Demonstrated experience leading internal audits and supporting external certification, surveillance, or recertification audits from planning through findings closure.
• Strong command of audit methodology, risk-based sampling, evidence sufficiency, control design and operation, nonconformity classification, root-cause analysis, and corrective-action validation.
• Exceptional policy-writing skills and ability to turn complex standards into concise, clear, maintainable policies and supporting procedures.
• Ability to translate compliance requirements into actionable, testable technical requirements for R&D teams and collaborate with engineering and product teams to operationalize them.
• Ability to interpret standards and convert requirements into clear control expectations, workable processes, and evidence guidance for non-auditors.
• Experience coordinating cross-functional governance forums or management review committees, with disciplined action tracking and follow-through.
• Excellent organization and time management; ability to independently manage competing audit cycles, evidence requests, deadlines, and stakeholders without losing detail.
• Clear, confident communication and negotiation skills, including respectfully challenging auditor requests or conclusions and supporting positions with objective evidence and documented rationale.
• Pragmatic, service-oriented approach to helping teams meet requirements while keeping the system credible, proportionate, and aligned to business operations.

Nice To Haves

• Experience auditing standards such as ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, or ISO 22301.
• Relevant lead auditor or lead implementer training or certification for one or more applicable ISO standards is strongly preferred.
• Experience with ISO/IEC 27701, ISO 22301, ISO/IEC 27017, ISO/IEC 27018, SOC 2, or related assurance frameworks.
• Experience with SaaS control environments, cloud operations, software development lifecycles, and distributed cross-functional teams.
• Familiarity with GRC, audit-management, evidence-collection, or workflow-automation platforms.
• CISA or similar certification.

Responsibilities

• Own the internal audit program for applicable ISO standards and management systems, including risk-based planning, audit execution, reporting, corrective actions, and follow-up validation.
• Serve as a subject matter expert across applicable ISO audit standards and support the evolution and integration of the QMS, PIMS, AIMS, and broader IMS.
• Own QMS governance, including process ownership and accountability, quality objectives and metrics, documented information, nonconformities, corrective actions, and management review.
• Lead and coordinate the IMS committee by setting agendas, preparing decision materials, tracking actions and owners, escalating overdue items, and maintaining records of decisions and outcomes.
• Coordinate QMS management review and related governance activities with appropriate leaders and process owners.
• Own and improve management-system policies, standards, procedures, and guidance; write clear and maintainable policy documents.
• Maintain audit-ready management-system documentation, including scope, policies, procedures, control mappings, risk and opportunity registers, objectives, metrics, management reviews, and evidence repositories.
• Translate standards, policies, and auditor requests into clear, testable technical requirements for R&D, engineering, product, and cloud teams, and partner with them on control implementation, ownership, evidence, and validation criteria.
• Help control owners produce evidence that is relevant, complete, current, and traceable to the control being tested.
• Coordinate certification and surveillance audits, customer assurance activities, and auditor requests; explain the management system, evidence, and rationale clearly.
• Evaluate evidence gaps, distinguish documentation issues from operating failures and control-design gaps, assess impact, agree on corrective actions, and track them through verified closure.
• Use professional judgment when evidence is incomplete or auditor interpretations are unclear; clarify the basis and scope of requests, challenge unsupported conclusions respectfully, identify valid alternative evidence, and document limitations, risks, and remediation transparently.
• Drive CAPA processes, root-cause analysis, and lessons learned so issues are addressed sustainably.
• Partner with Security, Privacy, AI Governance, Quality, Engineering, Product, Legal, and business teams to embed management-system requirements in SaaS operations.
• Identify opportunities to simplify controls, reduce duplicate evidence collection, automate recurring activities, and strengthen stakeholder trust.
• Provide leadership with concise, accurate reporting on audit readiness, findings, recurring themes, overdue actions, and management-system performance.

Benefits

• Comprehensive healthcare coverage
• Flexible PTO
• Equity RSUs
• Annual performance bonus opportunities
• Retirement account support
• 14+ weeks of paid parental leave
• Career development opportunities
• Company-paid privacy certification exam fees
• The role may also be eligible for discretionary bonuses, equity, and/or commissions.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed