IT Risk and Cybersecurity Auditor

Another way of working, growing professionally and personally, so you can unleash your full potential in a sustainable and inclusive way. To achieve this:
• We promote teamwork, mutual support, and participation.
• We personalize training to develop people's skills throughout their entire professional career.
• We offer the flexibility you need to maintain a good work-life balance.
• We believe in internal talent, and for that reason you will have multiple opportunities to take on new challenges and roles.
• We will take care of you through Zainduz, our wellness program, which includes: workshops on healthy habits and emotional well-being, digital physiotherapy services, and incentives for walking or cycling to work.
• We will provide you with access to the Lagun Aro medical plan for you and your family, as well as special banking and insurance conditions.

In short, we offer inclusive and respectful work environments, we guarantee equal opportunities between men and women in workplace dynamics and professional careers, and we strive to be a benchmark in equality.

• Degree or qualification in Computer Science, Information Technology Engineering, or related fields.
• Minimum 2 years of experience in risk-based ICT auditing.
• Knowledge of information systems auditing and general IT controls (CISA certification or similar is valued).
• Knowledge of internal auditing.
• Knowledge of cybersecurity, systems, network infrastructures, and communications.
• Familiarity with security, privacy, and business continuity control frameworks (NIST, ISO 2700X, ISO 22301, etc.).
• Knowledge of IT and cybersecurity regulations (DORA, NIS2, PCI DSS, GDPR, among others).
• Experience in risk management and internal control is valued (COSO, MAGERIT, ISO 27005, etc.).

Your mission will be to analyze and evaluate the technological infrastructure and the associated control framework, with the aim of ensuring that processes and systems run securely, reliably, and efficiently, in compliance with current regulations.

We will count on you to...

• Develop and execute audit programs, in line with the multi-year Internal Audit plan and business objectives.
• Collaborate in defining the audit plan, considering business needs and associated risks.
• Evaluate controls, analyze risks, and identify weaknesses during audits, proposing improvements and communicating them to the relevant areas.
• Prepare audit reports in accordance with established methodology and procedures.
• Participate in special projects: investigations, incident reviews, organizational analyses, ad hoc IT processes, and regulatory requirements.
• Follow up on the implementation of agreed corrective measures.