IT Auditor

Jobgether; United States; On-site; USD 107,000 - 120,000; Full time

Benefits offered by this job

Fully remote

Health insurance

Vision insurance

Dental insurance

Open PTO

9 paid holidays

401(k) plan

Year-end bonus

Parental leave

Life insurance

Udemy access

Job summary

Jobgether, partnering for a client, seeks an IT Auditor in the United States. This fully remote role strengthens and maintains information security compliance across PCI DSS, SOC 2 Type 2, GovRAMP/FedRAMP, and NIST 800-53 alignment.

You will lead audits, control testing, gap analyses, remediation and training, translating findings into practical controls while coordinating across IT, security and business teams.

Qualifications

• 4–6 years of IT audit/GRC experience.
• Experience with PCI DSS, SOC 2, GovRAMP/FedRAMP.
• GovRAMP/FedRAMP hands-on preferred.
• Knowledge of NIST 800-53 in GovRAMP contexts.
• CISA/CISSP/CISM; CISA preferred.
• Experience with a GRC tool (Vanta, Drata, OneTrust).
• Bachelor’s degree in IS/CS/Business or equivalent.
• Excellent written and verbal communication.

Responsibilities

• Own day-to-day compliance execution across PCI DSS, SOC 2, GovRAMP/FedRAMP.
• Conduct internal IT audits and control assessments with formal reports.
• Perform gap analyses and readiness assessments for audits.
• Assess controls aligned with NIST 800-53 for GovRAMP/FedRAMP.
• Administer GRC platform as central system of record.

Skills

IT audit

GRC

Compliance

Education

Bachelor’s degree in Information Systems/CS/Business

Tools

Vanta

Drata

Secureframe

OneTrust

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an IT Auditor based in the United States.

This role is responsible for strengthening and maintaining an organization’s information security compliance and governance posture across critical industry frameworks.

You will oversee day-to-day compliance activities spanning PCI DSS, SOC 2 Type 2, and GovRAMP/FedRAMP, ensuring controls and policies meet regulatory and contractual expectations.

The position combines internal auditing, control testing, gap analysis, remediation management, and cross-functional stakeholder engagement.

You will work closely with technical and business teams to turn audit findings into practical, sustainable security controls.

The role also provides visibility into client contract governance, external assessments, security policies, regulatory changes, and compliance training.

Success requires a rigorous and standards-driven approach balanced with pragmatism, collaboration, and the ability to find workable paths to compliance.

This is a fully remote opportunity for a seasoned IT audit or GRC professional who enjoys operating across teams and making a measurable impact on security and compliance

Accountabilities

• Own day-to-day compliance execution across PCI DSS, SOC 2 Type 2, and GovRAMP/FedRAMP, including audit preparation, evidence collection, control reviews, and remediation tracking.


• Conduct internal IT audits and control assessments, documenting findings and producing formal reports with clear, prioritized recommendations for improvement.


• Perform periodic gap analyses and readiness assessments to identify compliance weaknesses and prepare the organization for formal audits, assessments, and certification milestones.


• Assess, maintain, and monitor controls aligned with the NIST 800-53 framework as applicable to GovRAMP/FedRAMP authorization requirements.


• Administer the organization’s Governance, Risk, and Compliance (GRC) platform as the central system of record for controls, policies, evidence, and compliance activities.


• Provide guidance on client contract governance, evaluating security and compliance requirements to ensure contractual commitments are understood, achievable, and appropriately supported.


• Partner with departments across the organization—not only IT and Security—to educate employees, answer compliance questions, communicate requirements, and deliver relevant training.


• Hold department leaders accountable for their assigned compliance obligations, escalating persistent gaps and risks to senior leadership when appropriate.


• Draft, maintain, communicate, and enforce security policies and procedures across Security, IT, and other business functions.


• Manage relationships with external compliance organizations, third-party assessors, penetration testers, auditors, and compliance-related vendors.


• Monitor changes to PCI DSS, SOC 2, GovRAMP/FedRAMP, NIST 800-53, and other applicable regulatory or framework requirements, updating the compliance program as needed.


• Collaborate with Security Engineers and IT/Hosting teams to translate audit findings and compliance requirements into practical, implementable controls.


• Apply consistent standards while working collaboratively with stakeholders to identify compliant solutions rather than simply blocking business activities.

Requirements

• 4–6 years of professional experience in IT audit, information security compliance, Governance, Risk, and Compliance (GRC), or a closely related field.


• Demonstrated experience working across multiple security and compliance frameworks, ideally including PCI DSS, SOC 2, GovRAMP/FedRAMP, or comparable standards.


• Hands-on GovRAMP or FedRAMP experience is strongly preferred.


• Working knowledge of NIST 800-53 controls and their application within GovRAMP/FedRAMP authorization environments.


• Professional security certification such as CISA, CISSP, or CISM; CISA is preferred.


• Hands-on experience with a GRC platform such as Vanta, Drata, Secureframe, OneTrust, or an equivalent solution.


• Strong understanding of IT general controls (ITGCs), risk assessment methodologies, control testing, audit evidence, and remediation processes.


• Bachelor’s degree in Information Systems, Computer Science, Business, or a related discipline, or equivalent professional experience.


• Excellent written and verbal communication skills, with the ability to translate technical audit findings and compliance requirements into clear guidance for non-technical stakeholders.


• Strong cross-functional collaboration skills and a positive, solutions-oriented approach to compliance and risk management.


• Highly organized and capable of prioritizing multiple compliance activities, deadlines, assessments, and stakeholder requests.


• Demonstrated ability to work independently, exercise sound judgment, and maintain rigour while operating with limited supervision.


• Must be a U.S. citizen or Green Card holder and authorized to work in the United States without employment sponsorship.


• Ability to satisfy applicable background screening and security requirements associated with work involving governmental agencies and regulated environments.

Benefits

• Base salary of $107,000–$120,000 USD, with placement within the range based on experience, responsibilities, skills, and internal equity.


• Fully remote work from anywhere within the continental United States.


• Health insurance, with several plans fully covered for the employee and discounted coverage available for family members.


• Vision insurance fully covered for the employee, with discounted family coverage available.


• Dental insurance available for purchase.


• Flexible, open PTO policy available after 30 days of continuous service, plus nine paid holidays.


• 401(k) plan with company matching contributions to support long-term financial planning.


• Eligibility for an annual year-end performance bonus targeted at 7% of base salary.


• Up to eight weeks of paid parental leave.


• Company-paid life insurance and long-term disability insurance.


• Free Udemy access to support ongoing professional development and skills growth.


• Opportunity to work across cybersecurity, information security compliance, GRC, audit, and government-related security frameworks.


• High-impact role with significant cross-functional exposure and the opportunity to directly strengthen organizational security and compliance maturity.