Information Systems Auditor

Role Summary

We are seeking an Information Systems Auditor to join our fast-growing cybersecurity company and strengthen our governance, risk, and compliance capabilities at scale. This role plays a critical part in maintaining global certification readiness, enhancing control maturity, and embedding a proactive security and privacy mindset across the organization. Beyond audit execution, you will act as a strategic advisor to business and technology teams, shaping scalable and risk-aware processes in a cloud-native and AI-driven environment. You will contribute to the continuous evolution of our governance framework, ensuring alignment with international standards while enabling innovation and sustainable growth. This position directly supports regulatory confidence and reinforces the trust our global customers place in Picus.

Responsibilities

• Plan and execute risk-based IT and internal audits, with a strong focus on secure SDLC, software engineering processes, cloud infrastructure, and AI security domains,
• Evaluate and enhance the effectiveness of security and governance controls, driving continuous improvement across policies and processes,
• Manage audit and security vulnerability findings end-to-end, ensuring sustainable remediation and measurable control improvements,
• Lead and oversee global compliance programs (ISO/IEC 27001, 22301, 27701, 20000-1, SOC 2, NIST CSF, CSA STAR) to maintain continuous audit readiness,
• Actively support the Third-Party Risk Management (TPRM) program by participating in SaaS security assessments and vendor due diligence,
• Define and track key audit and compliance metrics, reporting insights to leadership and relevant stakeholders,
• Assess the risk and privacy impact of emerging technologies (AI, ML, and automation), guiding engineering teams on secure adoption practices.

What You Have

• 5+ years of hands-on experience in audit, compliance, risk management, or information security, preferably within a SaaS, cloud-native, or technology-driven environment,
• Hands-on experience with ISO/IEC standards (27001, 27701, 22301, 20000-1) and SOC 2, including preparation, audit coordination, and evidence management,
• Experience evaluating product security and Secure Software Development Lifecycle (SSDLC) practices from an audit and assurance perspective, including CI/CD pipeline controls, secure development practices, vulnerability management, software supply chain security, and SBOM governance,
• Experience advising cross-functional stakeholders and influencing control improvements in dynamic technology environments,
• Practical knowledge of international security and privacy regulations (e.g., GDPR, CCPA) and related compliance practices,
• Experience supporting or managing Third-Party Risk Management (TPRM), vendor due diligence, and customer-facing compliance processes,
• Proven ability to manage multiple audits and compliance initiatives simultaneously in a fast-paced environment,
• Strong verbal and written communication skills in English, including documentation and policy writing.

Requirements

Preferred Certifications

• ISO 27001, 22301, 27701, 20000-1 LA,
• ISACA certifications such as CISA, CISM, or CRISC, AAIA, AAISM, or AAIR,
• Experience with SOC 2, NIST, CSA STAR reporting frameworks.

Working at Picus

Fascinating work - a chance to shape and lead an exciting, fast-growing cyber security segment. Security Validation is a concept that helps organizations evaluate their security posture in a continuous, automated, and repeatable way. This approach allows for the identification of imminent threats, provides recommended actions, and produces valuable metrics about cyber-risk levels.

• Unlimited opportunity! We are growing. At Picus, you'll be provided with as much responsibility as you can handle - new career development opportunities constantly arise given our rate of growth.
• Global exposure - Get a lot of experience working not only in a fast-growing startup but also interact with customers all around the world.
• Be part of a global remote team who is taking on Exposure Validation and a growing market segment.

We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to age, sex, race, color, national origin, religious belief, gender or gender reassignment, sexual orientation, marriage or civil partnership, pregnancy and maternity, disability, protected veteran status, or any other characteristic protected by International law. Upon conditional offer of employment, candidates are required to complete reference and identity checks in line with local labor laws and as per the Company’s employment policy.

Picus Security processes candidates' personal data in accordance with applicable data protection laws. For detailed information on how your personal data is processed during the recruitment process, please review our Candidate Privacy Notice