Information Technology Auditor

GreenHat Assurance is a licensed CPA firm specializing in SOC 2 attestation engagements. We produce defensible Type I and Type II reports through rigorous scoping, disciplined sampling, and clear evidence documentation. We are now expanding our services to support ISO/IEC 27001 programs, bringing the same audit-grade rigor to Information Security Management Systems (ISMS) work.
Our approach is practical and evidence-driven. We care about quality, clarity, and documentation that stands up to scrutiny, whether you are preparing for ISO 27001 certification or strengthening an existing ISMS.
ROLE OVERVIEW
GreenHat Assurance is hiring a full-time ISO 27001 Auditor to support ISO/IEC 27001 engagements from planning through deliverables. This role is remote and focused on evaluating ISMS requirements, assessing control implementation, analyzing evidence, documenting results, and contributing to clear, high-quality reporting.
This is a strong fit for someone who enjoys technical environments, can communicate clearly, and wants to build deep expertise in ISO 27001 auditing, ISMS governance, and risk-based security programs.
WHAT YOU’LL DO (KEY RESPONSIBILITIES)
Plan and execute ISO/IEC 27001 engagements, including audit plans, request lists, interview schedules, and testing approaches.
Conduct ISMS walkthroughs and stakeholder interviews (security, IT, engineering, compliance, leadership), documenting in a clear, audit-ready format.
Assess ISMS scope, boundaries, context (Clause 4), leadership and governance (Clause 5), planning and risk management (Clause 6), support and documentation (Clause 7), and operational controls (Clause 8).
Evaluate performance evaluation and improvement processes (Clauses 9–10), including internal audit, management review, metrics, corrective actions, and continual improvement.
Review and validate core ISO 27001 artifacts such as the risk assessment methodology, risk treatment plan, Statement of Applicability, policies, procedures, and documented controls.
Test control design and operating effectiveness across relevant Annex A control areas (identity and access, cryptography, secure development, change management, logging and monitoring, incident management, supplier security, asset management, physical security, etc.).
Execute risk-based sampling and evidence evaluation, including completeness and accuracy considerations for system-generated evidence.
Analyze technical configurations and logs (where applicable), and translate technical details into clear, objective audit documentation.
Draft and refine workpapers that support conclusions, including narratives, test steps, results, and nonconformities or observations where applicable.
Contribute to engagement outputs, including clear findings, impact statements, and support for corrective action planning when needed.
Support internal quality reviews, responding to reviewer notes and improving documentation until it is publication-ready.
Identify scoping risks early (outsourced processes, shared responsibility boundaries, supplier dependencies, unclear scope statements) and escalate appropriately.
Help build the ISO 27001 practice by improving templates, checklists, evidence standards, and repeatable audit workflows.
WHAT SUCCESS LOOKS LIKE
Workpapers are consistently clean, complete, and easy to review.
Evidence clearly maps to ISO 27001 clauses and applicable Annex A controls without gaps or ambiguity.
You can run client interviews confidently, keep requests organized, and keep engagements moving.
Nonconformities and observations are written objectively, with clear support, clear impact, and actionable detail.
You improve each cycle: better scoping, stronger risk-based sampling, clearer writing, faster execution, stronger judgment.
You contribute to repeatable ISO 27001 methods that scale across clients.
QUALIFICATIONS (REQUIRED)
Strong skills in IT audit and information security controls assessment and validation.
Practical understanding of how security governance and controls operate in modern environments (cloud, SaaS, CI/CD, identity, logging, vendor ecosystems).
Working knowledge of ISO/IEC 27001 concepts, including ISMS scope, risk assessment and treatment, documented information, internal audit, and continual improvement.
Strong analytical ability to evaluate evidence, trace processes, and spot inconsistencies.
Clear writing and communication, including the ability to document complex systems in a readable way.
Strong organization skills (multiple clients, multiple deadlines, detail-heavy work).
CISA Certification
NICE TO HAVE (PREFERRED)
Experience supporting ISO/IEC 27001 audits, readiness assessments, internal audits, or certification preparation.
ISO 27001 Lead Auditor or Lead Implementer training/certification (IRCA or equivalent).
Familiarity with related frameworks (SOC 2, NIST, CIS, PCI, HIPAA) as context and mapping support.
Experience with modern SaaS stacks (identity providers, CI/CD, logging, ticketing, endpoint management).
Certifications such as CISM, CISSP, CPA (or progress toward them).
WORKING STYLE AND EXPECTATIONS
Remote work with a high standard for responsiveness, documentation quality, and follow-through.
Comfort working directly with technical stakeholders (security, engineering, IT).
Professional skepticism with a practical mindset: verify, document, and keep things moving.
Commitment to confidentiality, impartiality, and independence expectations consistent with audit work.

Work arrangement
Yes