IT Auditor / Auditor / Internal Audit

Relativity; Illinois; Hybrid; USD 178,000 - 266,000; Full time

Job summary

Relativity is seeking an experienced Staff IT Auditor to lead second-line assurance across its IT control landscape in a Hybrid/Remote setting in the United States, Illinois. The role emphasizes continuous testing of ITGCs and maintaining the RCM lifecycle, while advising first-line on control implementation and policy alignment.

The candidate will own risk reporting to CISO and senior leadership, drive cross-functional IT risk initiatives, and collaborate with ERM to align IT risk appetite with

Qualifications

• Extensive IT audit, risk management or compliance experience.
• Hands-on ITGC testing and assurance leadership experience.
• Deep knowledge of risk and control frameworks (NIST CSF, ISO 27001/27018, SOC 2, COSO).
• GRC certifications such as CISA/CISSP/CGEIT or equivalent.

Responsibilities

• Lead second-line IT control testing and risk assurance across the control landscape.
• Develop, maintain and improve the Risk and Control Matrix (RCM) lifecycle.
• Advise first-line on operationalization of controls and policy alignment.
• Communicate results, gaps and remediation plans to executives and stakeholders.

Skills

IT Audit

Risk Management

GRC

SOX

NIST CSF

FedRAMP

CISA

CISSP

RCM

Python

PowerShell

SQL

Tools

RCM tools

Programming languages

Job description

Posting Type Hybrid/Remote

The Staff IT Auditor leads second-line assurance for Relativity’s control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They are responsible for integrated, cross-functional IT control design and advise first-line on effective operationalization of controls. This role will be responsible for continuous testing of IT General Controls (ITGC) and the ongoing adaptation of Relativity’s Risk and Control Matrix (RCM) lifecycle. Expected to act and serve cross-functionally as the subject matter expert on all aspects of IT risk assurance and possess deep domain knowledge across IT governance, risk and compliance.

• Expert level risk reasoning and decisioning knowledge, with demonstrable risk management acumen.
• Expert level IT control architecture and necessary technical depth to rationalize.
• Expert level risk assurance engineering and use of technology for continuous control validation.
• Capable systems thinker that solves complex problems creatively – GRC isn’t the office of “No,” we expand the possibility of “Yes.”
• You effectively translate strategic intent to tactical execution with a high level of autonomy and quality.

Set and maintain the information security policies and standards aligned to management’s control framework and set the standards that the first line of defense operate against. Continuously assessing the adequacy and effectiveness of the controls placed in operation.

Identifying and reporting risks with high fidelity risk reasoning and decisioning quality and providing gap analyses and remediation plans to design and implement controls and/or suggesting risk treatment plans.

Continuously monitor control performance, design optimization plans to first line of defense for control rationalization and continued alignment and adherence to standards.

Own the end-to-end process of tracking, reporting and accounting for control deficiencies and exceptions, gaps and weaknesses.

Own, update and report on the information security’s risk register to the CISO, management and other enterprise stakeholders on a quarterly basis.

Define, aggregate, and report risk metrics to information security leadership, other executive stakeholders and the board.

Serve as the subject matter expert related to the nature, timing and extent of IT controls aligned to standardized frameworks. Ensures control environment supports and enables organizational strategic outcomes and reduces audit lifecycle burden to accelerate innovation and maintain organizational agility. Collaborates with ERM to set IT risk appetite ensuring it is aligned with organizational risk appetite and thresholds.

Sets IT control architectural standards and defines the authoritative technical position for control architecture aligned with risk taxonomy.

Accountable for decisions that carry enterprise-wide audit, certification, and customer trust consequences.

Maintains an advanced fluency in information security standards, benchmarks, frameworks and regulatory guidance as you are responsible for the proactive interpretation of framework revisions, shifts in industry standards and changes in assessor/auditor testing requirements.

Collaborates with third line of defense, internal audit and relevant stakeholders to successfully execute enterprise-wide integrated audits (e.g., Performs independent analysis around information security’s maturation and capabilities aligned with standards. Leads diagnosis of complex, cross-system, and ambiguous control failures with minimal supervision and working effectively in unfamiliar architecture, holding competing hypotheses without premature commitment, and producing high fidelity analysis that withstands independent technical and auditor scrutiny without rework.

Represents security in high-stakes forums with minimal supervision, briefing executives, customers, auditors, regulators and vendors on complex technical risk and control matters and produces data-driven positions that hold up under challenge with minimal correction.

• Collaborates extensively cross-organizationally to support SOX readiness initiatives and integrated audits; developing, designing and monitoring controls and subsequently optimizing them to reduce organizational cost of controls, creating efficiencies through control homogenization and ensuring we reduce detection risk across the entire control landscape. Reporting periodically to relevant stakeholders on progress, status, exceptions and the associated risk profile.
• 8+ years of professional experience in IT audit, risk management, or compliance, with substantial hands-on ITGC testing and experience leading assurance activities or programs.
• Deep knowledge of and experience with risk and control frameworks, including NIST CSF 2.0, NIST AI RMF, NIST 800-53, ISO/IEC 27001/27018, AICPA Trust Services Criteria (SOC 2), COSO, COBIT, FedRAMP Moderate and FedRAMP High and/or other comparable frameworks including objective/requirement translation, control rationalization and common-control cross-walking.
• Advanced or terminal GRC certifications such as Certified Information Security Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified in the Governance of Enterprise IT (CGEIT) or other relevant certifications.
• Proven experience designing, building, and monitoring Risk and Control Matrices (RCMs); defining RCM structure, leading periodic refreshes, and maintaining framework mappings at scale in partnership with Security Engineering, IT, and Product teams.
• Excellent written and verbal communication skills, with the ability to present testing results, deficiency themes, and risk posture to leadership and to technical and non-technical stakeholders.
• Deep understanding of the standard organizational governance models and demonstrated experience planning, scoping, executing, and overseeing a second line control testing program, including deficiency evaluation and reporting.
• Expert knowledge of information technology/security general controls, such as change management, access to programs and data, segregation of duties, asset management, computer operations, encryption practices, and secure systems development – and their relationship to application controls and data integrity.
• Experience utilizing AI tooling to support core responsibilities quickly, accurately, and efficiently.
• Experience reviewing the work of other analysts and upholding documentation standards suitable for internal and external audit reliance.
• 4+ years of GRC experience supporting FedRAMP Moderate (or higher) authorization and continuous monitoring activities. Technical proficiency with any programming language (e.g., Python, PowerShell, SQL, or similar)
• Experience implementing automated evidence collection or continuous control monitoring programs.
• Experience serving as primary liaison to external auditors, regulators and third-line of defense stakeholders.
• Experience mentoring, coaching, or functionally leading analysts.

This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.

178,000 and $266,000 The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity.

AICPA AT 101, Business Process Improvements, COBIT, COSO Framework, Federal Risk and Authorization Management Program (FedRAMP), Financial Services, Information Security, Internal Controls, ISO27001, ITGC, NIST 800-53, Process Improvements, Regulatory Compliance, Risk Compliance, Risk Management