IT Infrastructure, IAM and Cybersecurity Auditor (Hybrid)

We are looking for an IT Auditor specialized in Infrastructure, IAM and Cybersecurity to join a Technological Internal Audit team (Hybrid Madrid), evaluating technological and security controls in critical environments. The position will be focused on risk identification, control validation, the preparation of improvement recommendations, and compliance with regulatory and security standards in highly regulated environments.

• Participate in challenging projects with cutting-edge technologies.
• You will have autonomy to propose solutions and lead technically.

• Execute audits of technological infrastructure, cybersecurity, and Identity and Access Management (IAM).
• Evaluate logical access controls, privilege management, segregation of duties, and the least privilege model.
• Analyze the effectiveness of security controls associated with firewalls, monitoring platforms, SIEM, and critical technological environments.
• Review identity management processes, including onboarding, offboarding, modifications, and periodic access reviews.
• Evaluate data protection controls, credential management, and compliance with corporate security policies.
• Participate in business continuity audits, BCP/DRP plans, and operational resilience.
• Review technological risks associated with third parties and critical providers.
• Analyze technical evidence, execute audit tests, and document findings with traceability.
• Prepare working papers, executive reports, and recommendations oriented toward risk mitigation.
• Follow up on action plans derived from previous audits.
• Participate in follow-up meetings with technical and business areas.
• Contribute to audit testing automation and data analysis initiatives.

• Over 5 years of experience in IT Audit, Cybersecurity, or technological control review.
• Experience performing audits of technological infrastructure, IAM, and cybersecurity controls.
• Knowledge of Active Directory.
• Experience in privilege management (PAM).
• Knowledge of access and authentication controls.
• Knowledge of firewalls and perimeter security.
• Knowledge of data protection and credential management.
• Experience evaluating regulatory and control frameworks such as ISO 27001, ENS, DORA, and GDPR.
• Ability to identify risks, evaluate controls, and formulate improvement recommendations.
• Experience in the preparation and presentation of audit reports.
• English level sufficient to interpret technical documentation.

Valuable:

• CISA, CISSP, CRISC, or ISO 27001 Lead Auditor/Lead Implementer certifications.
• Experience in the financial sector or regulated environments.
• Knowledge of Python, ACL, or DBeaver for automation and data analysis.
• Experience in operational resilience, business continuity, or third-party risk audits.