IT Security Auditor

Job Summary:

The Senior IT Security Auditor / Technical Security SME is responsible for performing hands-on security control testing and technical evidence analysis across Lansweeper, Smartsheet, and Verint environments. This role supports the IT Security Audit Manager by conducting technical walkthroughs, sampling, and findings development to ensure compliance with SEC530 standards and related security frameworks. Responsibilities:

• Execute system-specific SEC530 audit procedures for Lansweeper (asset/endpoint), Smartsheet (SaaS), and Verint (VoIP/workforce optimization).
• Conduct technical walkthroughs with system owners and administrators; analyze exports, screenshots, configurations, logs, tickets, and vendor documentation.
• Test IAM controls including Okta-based authentication for Smartsheet, privileged access, contractor termination timeliness, logging, configuration management, vulnerability remediation, encryption, and backup/recovery.
• Assess controls across Lansweeper asset inventory, Smartsheet admin roles, and Verint Call Manager/UCCX infrastructure.
• Review third-party and vendor assurance documentation such as SOC 2 reports and coordinate additional evidence requests.
• Prepare complete, traceable, evidence-supported work papers for each system prior to exit conferences.
• Document control exceptions and draft initial findings including condition, criteria, cause, effect, and recommendations.
• Support findings validation, corrective action plan review, exit conferences, and final report preparation.

Required Skills & Certifications:

• 7+ years of experience in IT security assessment, IT audit, cybersecurity, or technology risk.
• 4+ years of hands-on technical security control testing, including working with remote evidence environments without direct system access.
• Demonstrated experience with SEC530, SEC502, and/or SEC520 standards.
• Experience testing SaaS platforms, asset/endpoint/ITSM-adjacent platforms, or VoIP/call-recording/workforce-optimization systems.
• Knowledge of NIST SP 800-53 control testing and identity providers such as Okta or comparable SSO/IdP.
• Experience preparing audit work papers, technical findings, and evidence-traceability documentation for government or regulated clients.
• IAM review skills including SSO/Okta, RBAC, and privileged access.
• Audit logging, security monitoring, and configuration/change management review capabilities.
• Vulnerability and patch management evidence review experience (excluding active scanning or penetration testing).
• Encryption, secure communications, and backup/recovery assessment expertise.
• Third-party assurance and SOC 2 report review and reliance experience.
• Audit sampling, evidence analysis, and findings development skills.

Preferred Skills & Certifications:

• CISA and/or CISSP certifications strongly preferred.
• Cloud or identity-focused certifications such as CCSP, Security+, CRISC, or relevant Microsoft/Okta security certifications are desirable.

Special Considerations:

• Work involves handling sensitive and regulated government or client data requiring strict adherence to confidentiality and security protocols.
• May require coordination with multiple system owners and vendors for evidence collection and validation.

Scheduling:

• Standard business hours with potential flexibility depending on audit timelines and coordination needs.