Staff IT Auditor (Information Security)

Location: Illinois, United States; hybrid/remote

Salary: $178,000–$266,000 annually, plus annual performance bonus and long-term incentives.

Company

hirify.global develops enterprise software and maintains information security, governance, risk, and compliance programs.

What you will do

• Lead second-line assurance activities under the IIA Three Lines Model, including continuous ITGC testing and optimization of the Risk and Control Matrix lifecycle.
• Set information security control standards, assess control effectiveness, identify risks, and develop gap analyses, remediation plans, and risk treatment plans.
• Own control deficiencies, exceptions, risk registers, risk metrics, and reporting to information security leadership, executives, and the board.
• Define IT control architecture, interpret framework obligations, rationalize overlapping requirements, and engineer controls into operational processes.
• Collaborate with internal audit, ERM, the CISO, management, and third-line stakeholders on SOX, ISO, FedRAMP, and other integrated audits.
• Lead FedRAMP Moderate and/or High pre-assessment reviews, validate authorization-package readiness, and identify gaps before external assessment.

Requirements

• 8+ years of professional experience in IT audit, risk management, or compliance, including substantial hands-on ITGC testing and leadership of assurance activities or programs.
• 4+ years of GRC experience supporting FedRAMP Moderate or higher authorization and continuous monitoring activities, with the ability to gain and maintain relevant U.S. federal clearances.
• Deep experience with NIST CSF 2.0, NIST AI RMF, NIST 800-53, ISO/IEC 27001/27018, AICPA Trust Services Criteria, COSO, COBIT, FedRAMP Moderate and High, or comparable frameworks.
• Experience translating objectives and requirements, rationalizing controls, and cross-walking common controls.
• Proven experience designing, building, monitoring, refreshing, and mapping Risk and Control Matrices at scale with Security Engineering, IT, and Product teams.
• Advanced or terminal GRC certification such as CISA, CISSP, or CGEIT, or another relevant certification.
• Advanced knowledge of IT and security general controls, including change management, access controls, segregation of duties, asset management, computer operations, encryption, secure systems development, application controls, and data integrity.
• Experience with GRC technologies, AI tooling, reviewing analysts’ work, and maintaining documentation suitable for internal and external audit reliance.
• Excellent written and verbal communication skills, governance-model knowledge, and experience planning, scoping, executing, and overseeing second-line control testing programs.

Nice to have

• Programming experience with Python, PowerShell, SQL, or another language.
• Experience integrating GRC systems, creating automated workflows, implementing automated evidence collection, or operating continuous control monitoring programs.
• Experience liaising with external auditors, regulators, and third-line stakeholders.
• Additional advanced or terminal certifications such as CRISC, CGRC, CCSP, ISSAP, CIA, or CISM.
• Experience mentoring, coaching, or functionally leading analysts.
• Strong problem-solving, critical-thinking, prioritization, and complex initiative-management skills.

Culture & Benefits

• Hybrid/remote work arrangement.
• Competitive base salary with annual performance bonus and long-term incentives.
• Work involving enterprise-wide audit, certification, customer trust, and organizational agility.