Information Technology Auditor

GreenHat Assurance is a licensed CPA firm specializing in SOC 2 attestation engagements. We produce defensible Type I and Type II reports through rigorous scoping, disciplined sampling, and clear evidence documentation. We are now expanding our services to support ISO/IEC 27001 programs, bringing the same audit-grade rigor to Information Security Management Systems (ISMS) work.

Our approach is practical and evidence-driven. We care about quality, clarity, and documentation that stands up to scrutiny, whether you are preparing for ISO 27001 certification or strengthening an existing ISMS.

ROLE OVERVIEW

GreenHat Assurance is hiring a full-time ISO 27001 Auditor to support ISO/IEC 27001 engagements from planning through deliverables. This role is remote and focused on evaluating ISMS requirements, assessing control implementation, analyzing evidence, documenting results, and contributing to clear, high-quality reporting.

This is a strong fit for someone who enjoys technical environments, can communicate clearly, and wants to build deep expertise in ISO 27001 auditing, ISMS governance, and risk-based security programs.

WHAT YOU’LL DO (KEY RESPONSIBILITIES)

• Plan and execute ISO/IEC 27001 engagements, including audit plans, request lists, interview schedules, and testing approaches.
• Conduct ISMS walkthroughs and stakeholder interviews (security, IT, engineering, compliance, leadership), documenting in a clear, audit-ready format.
• Assess ISMS scope, boundaries, context (Clause 4), leadership and governance (Clause 5), planning and risk management (Clause 6), support and documentation (Clause 7), and operational controls (Clause 8).
• Evaluate performance evaluation and improvement processes (Clauses 9–10), including internal audit, management review, metrics, corrective actions, and continual improvement.
• Review and validate core ISO 27001 artifacts such as the risk assessment methodology, risk treatment plan, Statement of Applicability, policies, procedures, and documented controls.
• Test control design and operating effectiveness across relevant Annex A control areas (identity and access, cryptography, secure development, change management, logging and monitoring, incident management, supplier security, asset management, physical security, etc.).
• Execute risk-based sampling and evidence evaluation, including completeness and accuracy considerations for system-generated evidence.
• Analyze technical configurations and logs (where applicable), and translate technical details into clear, objective audit documentation.
• Draft and refine workpapers that support conclusions, including narratives, test steps, results, and nonconformities or observations where applicable.
• Contribute to engagement outputs, including clear findings, impact statements, and support for corrective action planning when needed.
• Support internal quality reviews, responding to reviewer notes and improving documentation until it is publication-ready.
• Identify scoping risks early (outsourced processes, shared responsibility boundaries, supplier dependencies, unclear scope statements) and escalate appropriately.
• Help build the ISO 27001 practice by improving templates, checklists, evidence standards, and repeatable audit workflows.

WHAT SUCCESS LOOKS LIKE

• Workpapers are consistently clean, complete, and easy to review.
• Evidence clearly maps to ISO 27001 clauses and applicable Annex A controls without gaps or ambiguity.
• You can run client interviews confidently, keep requests organized, and keep engagements moving.
• Nonconformities and observations are written objectively, with clear support, clear impact, and actionable detail.
• You improve each cycle: better scoping, stronger risk-based sampling, clearer writing, faster execution, stronger judgment.
• You contribute to repeatable ISO 27001 methods that scale across clients.

QUALIFICATIONS (REQUIRED)

• Strong skills in IT audit and information security controls assessment and validation.
• Practical understanding of how security governance and controls operate in modern environments (cloud, SaaS, CI/CD, identity, logging, vendor ecosystems).
• Working knowledge of ISO/IEC 27001 concepts, including ISMS scope, risk assessment and treatment, documented information, internal audit, and continual improvement.
• Strong analytical ability to evaluate evidence, trace processes, and spot inconsistencies.
• Clear writing and communication, including the ability to document complex systems in a readable way.
• Strong organization skills (multiple clients, multiple deadlines, detail-heavy work).
• CISA Certification

NICE TO HAVE (PREFERRED)

• Experience supporting ISO/IEC 27001 audits, readiness assessments, internal audits, or certification preparation.
• ISO 27001 Lead Auditor or Lead Implementer training/certification (IRCA or equivalent).
• Familiarity with related frameworks (SOC 2, NIST, CIS, PCI, HIPAA) as context and mapping support.
• Experience with modern SaaS stacks (identity providers, CI/CD, logging, ticketing, endpoint management).
• Certifications such as CISM, CISSP, CPA (or progress toward them).

WORKING STYLE AND EXPECTATIONS

• Remote work with a high standard for responsiveness, documentation quality, and follow-through.
• Comfort working directly with technical stakeholders (security, engineering, IT).
• Professional skepticism with a practical mindset: verify, document, and keep things moving.
• Commitment to confidentiality, impartiality, and independence expectations consistent with audit work.