IT Applications and DevSecOps Auditor

We are looking for an Applications and DevSecOps IT Auditor for one of our clients located in Madrid2.16.1.2

• Stable project as (position). Indicating the most important technology/ies
• You will be part of a Technology Talent ecosystem

Main responsibilities

Audit of applications and technological processes

• Execute audits on applications, platforms, and software development processes.
• Evaluate the adequacy and effectiveness of the implemented technological controls.
• Analyze risks associated with the development, maintenance, and deployment of applications.
• Validate technical and documentary evidence related to the reviewed controls.

Review of DevSecOps controls

• Evaluate the integration of security controls within DevSecOps environments.
• Review continuous integration and continuous deployment (CI/CD) pipelines.
• Verify the application of secure development best practices.
• Analyze controls related to security testing, vulnerability management, and code review.

Risk management and compliance

• Verify compliance with internal policies, security standards, and regulatory requirements.
• Evaluate change management processes, version releases, and segregation of duties.
• Identify control weaknesses and opportunities for improvement.
• Prepare audit reports and follow up on remediation plans.

Cross-functional collaboration

• Work with Development, Cybersecurity, Infrastructure, Architecture, and Risk teams.
• Provide recommendations oriented towards continuous improvement and reduction of technological risks.

2.16.1.2

Requirements

Education

• Degree in Computer Engineering, Telecommunications, Cybersecurity, or similar.
• Specialized training in IT Audit, Risk Management, or Information Security is valued.

Experience

• Between 3 and 5 years of experience in IT audit, application security, or technological risk management.
• Experience reviewing software development environments and controls associated with the SDLC.
• Experience in analyzing technical evidence and preparing audit reports.
• Experience in regulated environments is valued.

Technical skills

• SDLC and secure development methodologies.
• DevSecOps and CI/CD environments.
• Change management and version control.
• Tools such as GitLab, Jenkins, Azure DevOps, or GitHub.
• Vulnerability analysis and security controls in applications.
• OWASP, NIST, COBIT, ISO 27001, and related control frameworks.
• Cloud computing concepts and modern application architectures.

Competencies

• Analytical skills and attention to detail.
• Critical thinking and a risk-based approach.
• Ability to interpret technical evidence and transform it into audit conclusions.
• Written and verbal communication skills.
• Organization and ability to work autonomously.
• Orientation towards continuous improvement and regulatory compliance.
• Ability to interact with technical teams and business areas.

We will especially value

• Certifications such as CISA, CRISC, CISSP, ISO 27001 Lead Auditor, or Security+.
• Experience in application auditing, DevSecOps control review, or secure development.
• Experience in highly regulated sectors such as banking, insurance, or telecommunications.

2.16.1.2