Senior IT Security Auditor / Technical Security SME Job

Job Summary:
We are seeking a Senior IT Security Auditor / Technical Security SME to perform hands-on SEC530 security control testing and technical evidence analysis across the Lansweeper, Smartsheet, and Verint environments, supporting the IT Security Audit Manager with technical walkthroughs, sampling, and findings development.
Key Responsibilities:
• Execute system-specific SEC530 audit procedures for Lansweeper (asset/endpoint), Smartsheet (SaaS), and Verint (VoIP/workforce optimization)
• Conduct technical walkthroughs with system owners/admins; analyze exports, screenshots, configs, logs, tickets, and vendor documentation
• Test IAM controls (including Okta-based auth for Smartsheet), privileged access, contractor termination timeliness, logging, config management, vulnerability remediation, encryption, backup/recovery
• Assess controls across Lansweeper asset inventory, Smartsheet admin roles, and Verint Call Manager/UCCX infrastructure
• Review third-party/vendor assurance documentation, including SOC 2 reports; coordinate additional evidence requests
• Prepare complete, traceable, evidence-supported work papers for each system prior to exit conferences
• Document control exceptions and draft initial findings (condition, criteria, cause, effect, recommendation)
• Support findings validation, corrective action plan review, exit conferences, and final report preparation
Required Skills & Certifications:
• 7+ years: IT security assessment, IT audit, cybersecurity, or technology risk experience
• 4+ years: hands-on technical security control testing, including remote-evidence environments without direct system access
• Demonstrated experience with SEC530, SEC502, and/or SEC520 standards
• Experience testing SaaS platforms, asset/endpoint/ITSM-adjacent platforms, or VoIP/call-recording/workforce-optimization systems
• Experience with NIST SP 800-53 control testing and identity providers (Okta or comparable SSO/IdP)
• Experience preparing audit work papers, technical findings, and evidence-traceability documentation for government/regulated clients
• IAM review skills (SSO/Okta, RBAC, privileged access)
• Audit logging, security monitoring, and configuration/change management review
• Vulnerability/patch management evidence review (no active scanning/pen testing)
• Encryption, secure communications, backup/recovery assessment
• Third-party assurance and SOC 2 report review/reliance
• Audit sampling, evidence analysis, and findings development
Preferred Skills & Certifications:
• CISA and/or CISSP strongly preferred (not required)
• Cloud or identity-focused certifications desirable — CCSP, Security+, CRISC, or relevant Microsoft/Okta security certification