IT Auditor & GRC Risk Assurance (Hybrid)

Academic Work Finland Oy; Ylöjärvi; Hybrid; EUR 56,000 - 85,000; Full time

Job summary

Academic Work Finland Oy is seeking an IT auditor who will drive internal IT governance and cybersecurity assurance. The role executes audits, evaluates control design and effectiveness, and translates findings into risk insights.

You will lead yearly assurance rounds, train application owners on compliance, and drive remediation of control gaps. A strong technical background combined with business communication is essential, with a hybrid work model mainly in Finland.

Qualifications

• At least three years of IT audit experience.
• Good understanding of identity and access management, security monitoring and logging, security operations and incident response.
• Familiarity with ISO 27001 and the NIS2 Directive or other cybersecurity frameworks (CIS/NIST).
• Competence in audit planning and execution, control design and testing, evidence review, reporting.

Responsibilities

• Execute internal audit plans covering IT general and cybersecurity controls.
• Evaluate compliance with internal IT policies and the NIS2 Directive.
• Review evidence, identify control gaps, recommend remediation actions and verify closure of findings.
• Support management reporting, internal presentations and continuous improvement of the assurance and compliance process.
• Utilize ServiceNow to create data, manage reports, and track audit evidence.

Skills

IT audit

IT compliance

Information security governance

Identity and access management

Security monitoring

Incident response

Vulnerability management

Stakeholder management

Report writing

Presentation skills

Training

Fluent English

ServiceNow

Tools

ServiceNow

Job description

Academic Work Finland Oy is seeking an IT auditor who will drive internal IT governance and cybersecurity assurance. The role executes audits, evaluates control design and effectiveness, and translates findings into risk insights.

You will lead yearly assurance rounds, train application owners on compliance, and drive remediation of control gaps. A strong technical background combined with business communication is essential, with a hybrid work model mainly in Finland.