IT Auditor

Contract IT Auditor / Risk Assessor

Location: Remote — must work during Eastern Standard Time business hours

Engagement: Contract, initial term of 3-5 months with potential extension

Start: As soon as possible

Reports to: IT Risk, Compliance, or Internal Audit Leadership

About the Role

We are seeking a technically capable Contract IT Auditor / Risk Assessor to help relaunch and execute our IT risk and controls assessment methodology.

Our business risk program has been operating successfully for more than a year. However, we have determined that our approach to IT risk and control assessments needs to be rebuilt. We are starting fresh with a revised methodology based on the organization’s top 20 IT risk areas and business functions.

The methodology, control requirements, and recommended testing procedures will be provided. Your responsibility will be to execute the assessment process: identify the appropriate Control Owner, explain the control and testing expectations, request and evaluate evidence, document the results, identify gaps, and help move approved risks and controls into our GRC platform.

This is a hands-on role for someone who combines IT audit and GRC experience with enough technical depth to engage credibly with infrastructure, cybersecurity, application, and operations teams. The ideal candidate is broad technically—“an inch deep and a mile wide”—and can ask informed questions across a wide range of IT environments.

Key Responsibilities

• Execute risk and control assessments across the organization’s prioritized IT risk areas.
• Review provided control descriptions and recommended test procedures, then translate them into practical assessment activities.
• Identify and engage the appropriate Control Owner or technical subject-matter expert.
• Explain the purpose of each control, the associated risk, and the evidence required to demonstrate that the control is operating.
• Request, collect, organize, and evaluate appropriate evidence, such as:
  • Policies and procedures.
  • System reports and configuration exports.
  • Access reviews and approval records.
  • Change tickets and release documentation.
  • Vulnerability and patch-management reports.
  • Security monitoring records and logs.
  • Backup, recovery, and operational reports.
  • Screenshots or other system-generated evidence.
• Assess whether controls are properly designed and operating effectively.
• Distinguish between complete, incomplete, insufficient, and unsupported evidence.
• Challenge unclear, inconsistent, or unsupported responses professionally and constructively.
• Identify control gaps, exceptions, deficiencies, and potential risks.
• Document testing procedures, evidence reviewed, results, conclusions, and recommended remediation.
• Follow up with Control Owners to resolve open questions and obtain missing evidence.
• Coordinate approval of assessed risks and control results with appropriate stakeholders.
• Work with Amber to upload approved risks, controls, evidence, and assessment results into the GRC platform.
• Help establish consistent, audit-ready documentation standards within the GRC system.
• Train and coach Control Owners so they can perform future assessments and maintain their controls independently.
• Educate Control Owners on:
  • The business and technology risks addressed by each control.
  • Their control responsibilities.
  • Acceptable evidence.
  • Testing frequency and procedures.
  • How to document and upload evidence in the GRC platform.
• Support current PCI audit activities and FDIC-related requests as needed.
• Track outstanding requests, findings, action items, and remediation commitments through completion.
• Escalate unresponsive Control Owners, unsupported assertions, or material control concerns appropriately.

Technical Scope

The successful candidate does not need to be the deepest expert in every technology. However, they must have sufficient practical knowledge to understand how controls operate and to determine whether evidence is credible.

Relevant experience may include:

• IT general controls.
• Identity and access management.
• Privileged access and segregation of duties.
• Patch and vulnerability management.
• Endpoint management, including tools such as Microsoft Intune or SCCM.
• Change and release management.
• Configuration and security baselines.
• Network and infrastructure operations.
• Cloud platforms and SaaS applications.
• Backup, disaster recovery, and business continuity.
• Security operations, logging, and monitoring.
• Incident response.
• Third-party and vendor risk.
• Data protection and encryption.
• Application controls and system interfaces.
• Asset and configuration management.
• IT operations and service management.

For example, when assessing a Patch Management control, you should be able to understand how patch compliance is measured, what systems are in scope, how exceptions are handled, and whether reports from Intune, SCCM, vulnerability-management platforms, or related tools sufficiently support the control conclusion.

Required Qualifications

• 5+ years of experience in IT audit, technology risk, cybersecurity compliance, GRC, controls assurance, or a closely related field.
• Experience executing IT control assessments from evidence request through documented conclusion.
• Strong understanding of IT general controls and cybersecurity control environments.
• Experience working directly with technical Control Owners, engineers, system administrators, and IT leadership.
• Ability to understand a broad range of technologies and operational processes without requiring deep specialization in a single platform.
• Experience evaluating whether evidence is relevant, sufficient, reliable, and complete.
• Strong written documentation and workpaper skills.
• Experience identifying control deficiencies and explaining risk in clear business language.
• Experience using a GRC platform or structured risk-and-control repository.
• Ability to manage multiple assessments, evidence requests, deadlines, and stakeholders independently.
• Strong interpersonal skills and the confidence to respectfully challenge incomplete or questionable responses.
• Ability to work remotely and maintain consistent availability during Eastern Time business hours.

Preferred Qualifications

• Experience in a regulated financial-services environment.
• Experience supporting PCI DSS, FDIC, FFIEC, GLBA, SOX, NIST, CIS, or similar requirements.
• Experience with GRC platforms such as ServiceNow GRC, Archer, AuditBoard, OneTrust, LogicGate, or comparable systems.
• CISA, CISSP, CRISC, CIA, CISM, or comparable certification.
• Experience creating Control Owner training or control self-assessment materials.
• Experience supporting external audits, regulatory examinations, or remediation programs.
• Familiarity with Microsoft security and endpoint-management technologies, including Intune, SCCM, Entra ID, and related reporting.

Success Measures

Success in this role will be measured by the ability to:

• Complete assessments across the prioritized risk areas using the new methodology.
• Obtain timely and appropriate evidence from Control Owners.
• Produce clear, defensible, audit-ready testing documentation.
• Identify unsupported claims, control gaps, and meaningful risk issues.
• Move approved risks and controls into the GRC platform accurately.
• Reduce the amount of follow-up required from internal IT risk and compliance staff.
• Enable Control Owners to perform future testing and evidence submissions independently.
• Support timely responses to PCI and FDIC-related requirements.
• Establish a repeatable, sustainable assessment process rather than simply completing one-time requests.