Staff IT Auditor

Relativity•Illinois, IL

1d•$178,000 - $266,000•Hybrid

About The Position

The Staff IT Auditor leads second-line assurance for Relativity’s control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. The role is responsible for integrated, cross-functional IT control design; advising first-line teams on effective control operationalization; continuously testing IT General Controls (ITGC); and adapting Relativity’s Risk and Control Matrix (RCM) lifecycle. The role serves cross-functionally as a subject matter expert in IT risk assurance, with deep knowledge of IT governance, risk, and compliance. This position develops and optimizes second-line activities, defines information security policies and control standards, assesses control adequacy and effectiveness, identifies and reports risks, and recommends remediation or risk treatment. It owns control deficiency tracking and the information security risk register, and reports risk metrics and program maturity to leadership and other stakeholders. The role sets IT control architecture standards, collaborates on risk appetite and certification strategy, and works with internal audit and other teams on integrated audits, including SOX, ISO, and FedRAMP. It also leads FedRAMP Moderate and/or High pre-assessment reviews and readiness activities. The successful candidate brings expert risk reasoning, IT control architecture, and assurance engineering skills; applies technology to continuous control validation; and can translate strategic priorities into execution with autonomy. The role requires strong stakeholder influence and communication, including the ability to explain complex technical risk matters clearly and represent security in high-stakes discussions with executives, customers, auditors, regulators, and vendors.

Requirements

At least 8 years of professional experience in IT audit, risk management, or compliance, including substantial hands-on ITGC testing and experience leading assurance activities or programs.
Deep knowledge and experience with risk and control frameworks, including NIST CSF 2.0, NIST AI RMF, NIST 800-53, ISO/IEC 27001/27018, AICPA Trust Services Criteria (SOC 2), COSO, COBIT, FedRAMP Moderate and FedRAMP High, or comparable frameworks; includes translating requirements into objectives, rationalizing controls, and cross-walking common controls.
Advanced or terminal GRC certification such as CISA, CISSP, CGEIT, or another relevant certification.
Experience designing, building, and monitoring Risk and Control Matrices (RCMs), including defining structure, leading periodic refreshes, and maintaining framework mappings at scale with Security Engineering, IT, and Product teams.
Excellent written and verbal communication skills, including presenting test results, deficiency themes, and risk posture to leadership and technical and non-technical stakeholders.
Deep understanding of organizational governance models and demonstrated experience planning, scoping, executing, and overseeing a second-line control testing program, including deficiency evaluation and reporting.
Expert knowledge of IT and security general controls, including change management, access to programs and data, segregation of duties, asset management, computer operations, encryption practices, and secure systems development, and their relationship to application controls and data integrity.
Extensive experience and knowledge working with GRC technologies.
Experience using AI tooling to support core responsibilities efficiently and accurately.
Experience reviewing other analysts’ work and maintaining documentation standards suitable for internal and external audit reliance.
At least 4 years of GRC experience supporting FedRAMP Moderate or higher authorization and continuous monitoring activities.
Ability to gain and maintain relevant U.S. federal clearances.

Nice To Haves

Technical proficiency with a programming language such as Python, PowerShell, or SQL.
Experience integrating and creating automated workflows to and from relevant GRC systems to improve process efficiency and efficacy.
Experience implementing automated evidence collection or continuous control monitoring programs.
Experience serving as the primary liaison to external auditors, regulators, and third-line-of-defense stakeholders.
Additional relevant advanced- or terminal-tier certifications beyond the minimum, such as CRISC, CGRC, CCSP, ISSAP, CIA, or CISM.
Experience mentoring, coaching, or functionally leading analysts.
Strong problem-solving and critical-thinking skills, with the ability to manage competing priorities and drive complex initiatives to completion.

Responsibilities

Develop, manage, monitor, and optimize second-line-of-defense activities.
Set and maintain information security policies and standards aligned with management’s control framework, and continuously assess the adequacy and effectiveness of controls.
Identify and report risks, provide gap analyses and remediation plans, and recommend control implementation or risk treatment plans.
Provide expertise, guidance, and interpretation on control requirements aligned with control objectives.
Monitor control performance and recommend optimization, rationalization, and alignment improvements to first-line teams.
Own end-to-end tracking, reporting, and accounting for control deficiencies, exceptions, gaps, and weaknesses.
Own, update, and report the information security risk register quarterly to the CISO, management, and enterprise stakeholders.
Define, aggregate, and report risk metrics to information security leadership, executives, and the board.
Serve as the subject matter expert on IT control nature, timing, and extent in relation to standardized frameworks; develop, maintain, monitor, and optimize the technical control environment.
Collaborate with ERM to set IT risk appetite in alignment with organizational risk appetite and thresholds.
Set IT control architectural standards and define authoritative technical positions aligned with the risk taxonomy.
Partner across the organization to embed controls in processes while balancing assurance, operational burden, and technical enablement.
Collaborate with the CISO, Director of GRC, and management stakeholders to define certification strategy and interpret framework obligations, rationalizing overlapping requirements into reusable control sets.
Interpret revisions to information security standards, benchmarks, frameworks, regulations, and assessor or auditor testing requirements.
Collaborate with third-line defense, internal audit, and stakeholders to execute integrated enterprise audits, including SOX, ISO, and FedRAMP audits.
Independently analyze information security maturity and capabilities against standards and provide semi-annual reports to the CTO, CAO, and CFO.
Diagnose complex, cross-system, and ambiguous control failures with minimal supervision, producing analysis that withstands technical and auditor scrutiny.
Represent security in high-stakes forums and brief executives, customers, auditors, regulators, and vendors on technical risk and control matters.
Support SOX readiness and integrated audits by designing, monitoring, and optimizing controls, reducing control costs, improving efficiency through control homogenization, and reducing detection risk.
Report progress, status, exceptions, and associated risk profiles to relevant stakeholders.
Lead and execute pre-assessment reviews of FedRAMP Moderate and/or High authorization packages, validate readiness, and identify gaps before external AO and 3PAO reviews.