ISO Internal Auditor

Select how often (in days) to receive an alert:
Create Alert

We are a leading international law firm for global corporations, financial institutions, capital market participants and investment fund managers. With a global presence spanning the Americas, Europe, the Middle East and Asia, we advise on the laws of Bermuda, the British Virgin Islands, the Cayman Islands, Guernsey, Ireland and Jersey.

We treat everyone as the intelligent professional they are. Our approach is to trust and empower our people to deliver consistently, and enable them to succeed. Diversity is our secret weapon – it’s the sheer breadth of Walkers people that makes us who we are – gathered from across the globe and fluent in languages, jurisdictions and cultures that help us to mirror our clients and keep our own thinking in tune with the world in which we operate.

Office:
London (hybrid 50% required)

An opportunity has arisen for an Internal Auditor to join the firm’s Internal Audit function, with primary responsibility for providing independent assurance over the firm’s Information Security Management System (ISMS) and its alignment with ISO 27001 requirements. The role will plan and perform risk-based audits of the ISMS and applicable Annex A controls, assessing both their design adequacy and operating effectiveness through interviews, process walkthroughs, evidence review and control testing.

The successful candidate will produce clear, timely reports setting out audit conclusions, control observations and practical recommendations to support the effective implementation, maintenance and continual improvement of the ISMS. While the role will principally focus on ISO 27001, the Internal Auditor may also support other audits across the Internal Audit plan, including regulatory, financial crime, governance and terms of engagement reviews.

• Plan and deliver risk-based internal audits of the ISMS in accordance with the approved Internal Audit plan and established audit methodology.
• Assess the ISMS against the requirements of ISO/IEC 27001, relevant internal policies and procedures, and the firm’s defined information security objectives.
• Evaluate the design adequacy and operating effectiveness of applicable Annex A controls and requirements of the ISO 27001 Standard, including whether controls are appropriately documented, implemented and maintained.
• Perform audit fieldwork through stakeholder interviews, process walkthroughs, document and evidence review, control testing, data analysis and sample-based testing, using both remote and in-person approaches where appropriate.
• Maintain clear and comprehensive audit working papers that accurately document the scope, methodology, evidence reviewed, testing performed, conclusions reached and supporting rationale.
• Identify control weaknesses, non-conformities and opportunities for improvement, assessing their associated risks and potential impact on the effectiveness of the ISMS.
• Prepare clear, concise and balanced audit reports setting out the audit scope, overall conclusions, strengths, findings, root causes, risks and practical recommendations.
• Present and discuss audit findings with relevant stakeholders, constructively challenging management responses and supporting the agreement of proportionate and achievable remedial actions.
• Monitor and validate the implementation of agreed management actions, including reviewing supporting evidence and reporting overdue or insufficiently addressed actions through the appropriate governance channels.
• Support the development of the annual Internal Audit plan by contributing information security insight, identifying emerging risks and recommending areas for future assurance…