Staff IT Auditor

Posting Type

Hybrid/Remote

Job Overview

The Staff IT Auditor leads second-line assurance for Relativity's control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They are responsible for integrated, cross-functional IT control design and advise first-line on effective operationalization of controls. This role will be responsible for continuous testing of IT General Controls (ITGC) and the ongoing adaptation of Relativity's Risk and Control Matrix (RCM) lifecycle. Expected to act and serve cross-functionally as the subject matter expert on all aspects of IT risk assurance and possess deep domain knowledge across IT governance, risk and compliance.

The following are key to success in this role:

o Expert level risk reasoning and decisioning knowledge, with demonstrable risk management acumen.

o Expert level IT control architecture and necessary technical depth to rationalize.

o Expert level risk assurance engineering and use of technology for continuous control validation.

o Capable systems thinker that solves complex problems creatively - GRC isn't the office of "No," we expand the possibility of "Yes."

o You effectively translate strategic intent to tactical execution with a high level of autonomy and quality.

o You take pride in your work and own outcomes of efforts assigned to you.

o You are able to translate, communicate and navigate stakeholder collaboration with a high degree of influence and effectively communicate complex technical matters in simple well-understood ways.

o Excellent command and advanced fluency in common security frameworks, regulations and industry standards at the global level.

Job Description and Requirements

What are the core duties of this role?

• Develop, manage, monitor and optimize the second line of defense activities.

• Set and maintain the information security policies and standards aligned to management's control framework and set the standards that the first line of defense operate against. Continuously assessing the adequacy and effectiveness of the controls placed in operation.

• Identifying and reporting risks with high fidelity risk reasoning and decisioning quality and providing gap analyses and remediation plans to design and implement controls and/or suggesting risk treatment plans.

• Provide expertise, guidance and interpretation around control requirements aligned with control objectives.

• Continuously monitor control performance, design optimization plans to first line of defense for control rationalization and continued alignment and adherence to standards.

• Own the end-to-end process of tracking, reporting and accounting for control deficiencies and exceptions, gaps and weaknesses.

• Own, update and report on the information security's risk register to the CISO, management and other enterprise stakeholders on a quarterly basis.

• Define, aggregate, and report risk metrics to information security leadership, other executive stakeholders and the board.

• Serve as the subject matter expert related to the nature, timing and extent of IT controls aligned to standardized frameworks. Ensures control environment supports and enables organizational strategic outcomes and reduces audit lifecycle burden to accelerate innovation and maintain organizational agility. Develop, maintain, monitor and optimize technical control environment.

• Collaborates with ERM to set IT risk appetite ensuring it is aligned with organizational risk appetite and thresholds.

• Sets IT control architectural standards and defines the authoritative technical position for control architecture aligned with risk taxonomy.

• Partners across the organization to engineer processes that embed controls providing high degree of assurance and balances operational burden and technical enablement.

• Accountable for decisions that carry enterprise-wide audit, certification, and customer trust consequences.

• Collaborates with the CISO, Director of GRC and relevant management stakeholders in defining organizational certification strategy and leads interpretation of framework obligations, rationalizing overlapping requirements into a single control set with defensible inheritance and reuse.

• Maintains an advanced fluency in information security standards, benchmarks, frameworks and regulatory guidance as you are responsible for the proactive interpretation of framework revisions, shifts in industry standards and changes in assessor/auditor testing requirements.

• Collaborates with third line of defense, internal audit and relevant stakeholders to successfully execute enterprise-wide integrated audits (e.g., SOX, ISO, FedRAMP, etc…)

• Performs independent analysis around information security's maturation and capabilities aligned with standards. Provides semi-annual reports to CTO, CAO and CFO on security programs' maturation.

• Leads diagnosis of complex, cross-system, and ambiguous control failures with minimal supervision and working effectively in unfamiliar architecture, holding competing hypotheses without premature commitment, and producing high fidelity analysis that withstands independent technical and auditor scrutiny without rework.

• Represents security in high-stakes forums with minimal supervision, briefing executives, customers, auditors, regulators and vendors on complex technical risk and control matters and produces data-driven positions that hold up under challenge with minimal correction.

• Collaborates extensively cross-organizationally to support SOX readiness initiatives and integrated audits; developing, designing and monitoring controls and subsequently optimizing them to reduce organizational cost of controls, creating efficiencies through control homogenization and ensuring we reduce detection risk across the entire control landscape. Reporting periodically to relevant stakeholders on progress, status, exceptions and the associated risk profile.

• Lead and execute pre-assessment reviews of FedRAMP moderate and/or high authorization packages aligned to relevant criteria. Validating readiness and identifying gaps, ensuring assessment readiness before external AO and 3PAO review activities.

Minimum qualifications:

• 8+ years of professional experience in IT audit, risk management, or compliance, with substantial hands-on ITGC testing and experience leading assurance activities or programs.
• Deep knowledge of and experience with risk and control frameworks, including NIST CSF 2.0, NIST AI RMF, NIST 800-53, ISO/IEC 27001/27018, AICPA Trust Services Criteria (SOC 2), COSO, COBIT, FedRAMP Moderate and FedRAMP High and/or other comparable frameworks including objective/requirement translation, control rationalization and common-control cross-walking.
• Advanced or terminal GRC certifications such as Certified Information Security Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified in the Governance of Enterprise IT (CGEIT) or other relevant certifications.
• Proven experience designing, building, and monitoring Risk and Control Matrices (RCMs); defining RCM structure, leading periodic refreshes, and maintaining framework mappings at scale in partnership with Security Engineering, IT, and Product teams.
• Excellent written and verbal communication skills, with the ability to present testing results, deficiency themes, and risk posture to leadership and to technical and non-technical stakeholders.
• Deep understanding of the standard organizational governance models and demonstrated experience planning, scoping, executing, and overseeing a second line control testing program, including deficiency evaluation and reporting.
• Expert knowledge of information technology/security general controls, such as change management, access to programs and data, segregation of duties, asset management, computer operations, encryption practices, and secure systems development - and their relationship to application controls and data integrity.
• Expansive experience and knowledge working with GRC technologies.
• Experience utilizing AI tooling to support core responsibilities quickly, accurately, and efficiently.
• Experience reviewing the work of other analysts and upholding documentation standards suitable for internal and external audit reliance.
• 4+ years of GRC experience supporting FedRAMP Moderate (or higher) authorization and continuous monitoring activities. Ability to gain and maintain relevant U.S. federal clearances.

Preferred qualifications:

• Technical proficiency with any programming language (e.g., Python, PowerShell, SQL, or similar)
• Experience integrating and creating automated workflows to/from relevant GRC systems to increase process efficiency and efficacy.
• Experience implementing automated evidence collection or continuous control monitoring programs.
• Experience serving as primary liaison to external auditors, regulators and third-line of defense stakeholders.
• Additional relevant, advanced- or terminal-tier certifications beyond the minimum (e.g., CRISC, CGRC, CCSP, ISSAP, CIA, CISM)
• Experience mentoring, coaching, or functionally leading analysts.
• Strong problem-solving and critical thinking skills, with the ability to manage competing priorities and drive complex initiatives to completion.

Relativity is committed to competitive, fair, and equitable compensation practices.

This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.

The expected salary range for this role is between following values:

$178,000 and $266,000

The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.

Required Skills:

AICPA AT 101, Business Process Improvements, COBIT, COSO Framework, Federal Risk and Authorization Management Program (FedRAMP), Financial Services, Information Security, Internal Controls, ISO27001, ITGC, NIST 800-53, Process Improvements, Regulatory Compliance, Risk Compliance, Risk Management