Internal Auditor

About the role

We are seeking an experienced Internal Auditor to support the business in achieving its objectives by conducting audits of our Global Information Security Management System (ISMS). Reporting to the Group Security Audit & Assurance Manager, the role involves technology, information security, cybersecurity and compliance audits to assess ISO 27001 controls.

Key responsibilities

• Conduct technology, information security, cybersecurity and compliance audits to assess design, efficiency and effectiveness of internal security controls.
• Lead remediation discussions with stakeholders, providing clear guidance and ensuring timely resolution of findings.
• Develop audit plans, define scope and objectives, and deliver audit assignments within agreed timelines.
• Engage with internal stakeholders, maintain professionalism and ensure successful delivery of audit engagements.
• Perform remote auditing activities, including assessments of physical security controls.
• Serve as escalation point for internal audit queries, providing expert guidance.
• Produce high‑quality audit documentation, reports and supporting evidence.
• Prepare and deliver monthly KPI/KRI reporting and support coordination of global ISO 27001 external audits.

Required profile

• Exceptional attention to detail with strong analytical, reporting and communication capabilities.
• Clear and confident communicator able to translate complex security concepts for technical and non‑technical audiences.
• Strong stakeholder management skills focused on delivering excellent customer experience.
• Proactive, self‑motivated problem solver who can work independently and manage multiple workstreams.
• Flexible, approachable team player thriving in fast‑paced, collaborative environments.

Required skills

• ISO/IEC 27001:2022 Lead Auditor certification and practical audit experience.
• Knowledge of ISO 31000 risk management guidelines.
• Familiarity with NIST Cybersecurity Framework (CSF) and CIS Controls.
• Understanding of GDPR, UK Data Protection Act, EU AI Act and India Digital Personal Data Protection Act.
• Experience with risk assessment methodologies and security incident response processes.