IT Auditor

The Staff IT Auditor leads second-line assurance for Relativity's control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They are responsible for integrated, cross-functional IT control design and advise first-line on effective operationalization of controls. This role will be responsible for continuous testing of IT General Controls (ITGC) and the ongoing adaptation of Relativity's Risk and Control Matrix (RCM) lifecycle.

Expected to act and serve cross-functionally as the subject matter expert on all aspects of IT risk assurance and possess deep domain knowledge across IT governance, risk and compliance. The following are key to success in this role:

• Expert level risk reasoning and decisioning knowledge, with demonstrable risk management acumen.
• Expert level IT control architecture and necessary technical depth to rationalize.
• Expert level risk assurance engineering and use of technology for continuous control validation.
• Capable systems thinker that solves complex problems creatively – GRC isn't the office of "No", we expand the possibility of "Yes".
• You effectively translate strategic intent to tactical execution with a high level of autonomy and quality.
• You take pride in your work and own outcomes of efforts assigned to you.
• You are able to translate, communicate and navigate stakeholder collaboration with a high degree of influence and effectively communicate complex technical matters in simple well-understood ways.
• Excellent command and advanced fluency in common security frameworks, regulations and industry standards at the global level.

What are the core duties of this role?

Develop, manage, monitor and optimize the second line of defense activities. Set and maintain the information security policies and standards aligned to management’s control framework and set the standards that the first line of defense operate against. Continuously assessing the adequacy and effectiveness of the controls placed in operation. Identifying and reporting risks with high fidelity risk reasoning and decisioning quality and providing gap analyses and remediation plans to design and implement controls and/or suggesting risk treatment plans.

Provide expertise, guidance and interpretation around control requirements aligned with control objectives. Continuously monitor control performance, design optimization plans to first line of defense for control rationalization and continued alignment and adherence to standards. Own the end-to-end process of tracking, reporting and accounting for control deficiencies and exceptions, gaps and weaknesses. Own, update and report on the information security’s risk register to the CISO, management and other enterprise stakeholders on a quarterly basis.

Define, aggregate, and report risk metrics to information security leadership, other executive stakeholders and the board. Serve as the subject matter expert related to the nature, timing and extent of IT controls aligned to standardized frameworks. Ensures control environment supports and enables organizational strategic outcomes and reduces audit lifecycle burden to accelerate innovation and maintain organizational agility. Develop, maintain, monitor and optimize technical control environment.

Collaborates with ERM to set IT risk appetite ensuring it is aligned with organizational risk appetite and thresholds. Sets IT control architectural standards and defines the authoritative technical position for control architecture aligned with risk taxonomy. Partners across the organization to engineer processes that embed controls providing high degree of assurance and balances operational burden and technical enablement.…