Staff IT Auditor

Relativity ODA LLC; United States; Hybrid; USD 130,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Job summary

Relativity ODA LLC is seeking a Staff IT Auditor to lead second-line assurance across Relativity's IT control landscape under the IIA Three Lines Model. The role focuses on continuous testing of IT General Controls (ITGC) and evolving the Risk and Control Matrix lifecycle, serving as a subject matter expert in IT governance, risk, and compliance across global standards.

The ideal candidate will translate strategic intent into tactical execution with autonomy, influence stakeholders, and

Qualifications

• Develop, manage, monitor and optimize the second line of defense activities.
• Identify and report risks with high fidelity risk reasoning and decisioning quality; provide gap analyses and remediation plans.
• Provide expertise, guidance and interpretation around control requirements.

Responsibilities

• Develop, manage, monitor and optimize the second line of defense activities.
• Identify and report risks with high fidelity risk reasoning and decisioning quality; provide gap analyses and remediation plans.
• Provide guidance around control requirements and interpretation.
• Monitor control performance and design optimization plans for first line of defense.

Skills

Risk management

ITGC controls

GRC frameworks

Stakeholder communication

Audit automation

Job description

Posting Type Hybrid/Remote

Job Overview

The Staff IT Auditor leads second-line assurance for Relativity's control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They are responsible for integrated, cross-functional IT control design and advise first-line on effective operationalization of controls. This role will be responsible for continuous testing of IT General Controls (ITGC) and the ongoing adaptation of Relativity's Risk and Control Matrix (RCM) lifecycle. Expected to act and serve cross-functionally as the subject matter expert on all aspects of IT risk assurance and possess deep domain knowledge across IT governance, risk and compliance.

The following are key to success in this role:

• Expert level risk reasoning and decisioning knowledge, with demonstrable risk management acumen.
• Expert level IT control architecture and necessary technical depth to rationalize.
• Expert level risk assurance engineering and use of technology for continuous control validation.
• Capable systems thinker that solves complex problems creatively - GRC isn't the office of "No," we expand the possibility of "Yes."
• You effectively translate strategic intent to tactical execution with a high level of autonomy and quality.
• You take pride in your work and own outcomes of efforts assigned to you.
• You are able to translate, communicate and navigate stakeholder collaboration with a high degree of influence and effectively communicate complex technical matters in simple well-understood ways.
• Excellent command and advanced fluency in common security frameworks, regulations and industry standards at the global level.

Job Description and Requirements

What are the core duties of this role?

Develop, manage, monitor and optimize the second line of defense activities. Set and maintain the information security policies and standards aligned to management's control framework and set the standards that the first line of defense operate against. Continuously assessing the adequacy and effectiveness of the controls placed in operation.

Identifying and reporting risks with high fidelity risk reasoning and decisioning quality and providing gap analyses and remediation plans to design and implement controls and/or suggesting risk treatment plans.

Provide expertise, guidance and interpretation around control requirements aligned with control objectives.

Continuously monitor control performance, design optimization plans to first line of defense for control rationalization and continued alignment and adherence to standards.

Own the end-to-end process of tracking, reporting and accounting for control deficiencies and exceptions, gaps and weaknesses.

Own, update and report on the information security's risk register to the CISO, management and other enterprise stakeholders on a quarterly basis.

Define, aggregate, and report risk metrics to information security leadership, other executive stakeholders and the board.

Serve as the subject matter expert related to the nature, timing and extent of IT controls aligned to standardized frameworks. Ensures control environment supports and enables organizational strategic outcomes and reduces audit lifecycle burden to accelerate innovation and maintain organizational agility. Develop, maintain, monitor and optimize technical control environment. Collaborates with ERM to set IT risk appetite ensuring it is aligned with organizational risk appetite and thresholds.

Sets IT control architectural standards and defines the authoritative technical position for control architecture aligned with risk taxonomy.

Partners across the organization to engineer processes that embed controls providing high degree of assurance and balances operational burden and technical enablement.

Accountable for decisions that carry enterprise-wide audit, certification, and customer trust consequences.

Collaborates with the CISO, Director of GRC and relevant management stakeholders in defining organizational certification strategy and leads interpretation of framework obligations, rationalizing overlapping requirements into a single control set with defensible inheritance and reuse.

Maintains an advanced fluency in information security standards, benchmarks, frameworks and regulatory guidance as you are responsible for the proactive interpretation of framework revisions, shifts in industry standards and changes in assessor/auditor testing requirements.

Collaborates with third line of defense, internal audit and relevant stakeholders to successfully execute enterprise-wide integrated audits (e.g., SOX, ISO, FedRAMP, etc...).

Performs independent analysis around information security's maturation and capabilities aligned with standards. Provides semi-annual reports to CTO, CAO and CFO on security programs' maturation.

Leads diagnosis of complex, cross-system, and ambiguous control failures with minimal supervision and working effectively in unfamiliar architecture, holding competing hypotheses withou