IT Auditor

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of daily compliance execution for PCI DSS, SOC 2 Type 2, and GovRAMP, encompassing audit preparation, evidence gathering, and remediation tracking.

• Perform internal audits and control evaluations; generate formal reports detailing findings and prioritized suggestions for enhancements.

• Carry out regular gap analyses and readiness evaluations prior to official audits or certification milestones.

• Evaluate and uphold controls in accordance with the NIST 800-53 control framework as it pertains to GovRAMP/FedRAMP authorization.

• Oversee and manage Brandt's GRC tool as the authoritative system for controls, policies, and evidence.

• Offer guidance on client contract governance, ensuring security and compliance terms are comprehensible and achievable before commitments are finalized.

• Collaborate with all departments to inform staff about compliance requirements, address inquiries, and provide training.

• Ensure department heads are accountable for their compliance responsibilities; escalate ongoing gaps to the CIO.

• Create, maintain, and enforce company security policies.

• Cultivate relationships with external compliance entities, third-party assessors, penetration testers, and compliance-related vendors.

• Track changes in regulatory and framework requirements and adjust Brandt's compliance program as necessary.

• Work alongside Security Engineers and IT/Hosting teams to convert audit findings into actionable, implementable controls.

• Balance thoroughness with practicality by collaborating with stakeholders to identify compliant solutions.

⛳️ Requirements

• Must be a US Citizen or Green Card holder.

• 4–6 years of experience in IT audit, information security compliance, or GRC, ideally across multiple frameworks (PCI DSS, SOC 2, GovRAMP/FedRAMP, or similar).

• Experience with GovRAMP or FedRAMP is highly preferred.

• Familiarity with NIST 800-53 controls and their relevance to GovRAMP/FedRAMP authorization.

• Security certification such as CISA, CISSP, or CISM (CISA is preferred).

• Practical experience with a GRC platform (e.g., Vanta, Drata, Secureframe, OneTrust, or equivalent).

• Working knowledge of IT general controls (ITGCs), risk assessment methodologies, and control testing.

• Proven experience collaborating cross-functionally with a positive, solutions-focused attitude.

• Exceptional written and verbal communication skills; capable of translating technical findings for non-technical audiences.

• Bachelor’s degree in Information Systems, Computer Science, Business, or a related field, or equivalent experience.

🏝️ Benefits

• Health insurance, with several plans fully covered for you and discounted coverage for family members.

• Vision insurance fully covered for you, with discounted coverage available for family members; dental insurance available for purchase.

• A flexible, open PTO policy available after 30 days of continuous service, plus nine paid holidays.

• A 401(k) plan with company matching contributions, plus eligibility for an annual year-end performance bonus targeted at 7% of base salary.

• Up to eight weeks of paid parental leave.

• Life insurance and long-term disability insurance, both fully covered by the company.

• A free Udemy account for ongoing professional development.