Sr. IT Auditor, Corporate Technology & Cybersecurity

First American Title Insurance Co offers a strong total rewards package alongside hybrid work in Santa Ana, CA
. This role supports day-to-day delivery of technology and cybersecurity audit work, with opportunities to lead configuration-focused testing and help shape evidence-based conclusions for management review. The pay range for this position is $97,700.00 to $ annually
, with base pay determined by factors such as job-related knowledge, skills, experience, business requirements, and geographic location.

You will lead the day-to-day planning and fieldwork for assigned technology and cybersecurity audits, including walkthroughs, risk and control mapping, test procedures, sampling, and work allocation. You will coordinate milestones and provide status reporting as you guide auditors through procedures that produce traceable, evidence-based conclusions for Manager review.

• Partner with the Manager to refine audit objectives and scope, identifying dependencies, system boundaries, shared services, relevant regulations, and program components that could leave material risks unaddressed.
• Run day-to-day discussions with control owners, technical SMEs, and project stakeholders, including walkthroughs and clarification of evidence requests.
• Guide Staff auditors on completing test procedures, collecting and validating evidence, documenting results, and following up on exceptions.
• Review work papers for accuracy, traceability, and alignment with the approved test approach.
• Execute assigned procedures such as process walkthroughs, control assessment, population validation, sample selection, evidence inspection, reperformance, and follow-up testing.
• Perform configuration-focused testing across technology and security control areas, including security operations, incident response, endpoint and network security, data protection, penetration testing, application security, vulnerability and patch management, IAM, cloud, IT operations, change management, Secure SDLC, and business continuity/disaster recovery.
• Inspect security-technology configurations and supporting evidence, comparing sampled settings and rules to approved baselines and requirements, and assessing logging, monitoring, access, changes, encryption, certificates, and documented exceptions as applicable.
• Evaluate evidence for relevance, reliability, completeness, and consistency with control objectives; identify gaps, contradictory information, or scope limitations and raise them promptly with the Lead.
• Document procedures, evidence, sampling details, results, exceptions, and conclusions in clear, traceable work papers that meet Internal Audit quality standards.
• Analyze exceptions for cause, impact, extent, and possible compensating controls, supporting observations and practical recommendations.
• Use data analysis, scripts, and audit tools where appropriate to validate populations, identify anomalies, and improve testing coverage.
• Help prepare status updates, report content, issue validation, and examination support materials; incorporate review comments and maintain organized audit files.
• Draft audit findings, recommendations, management responses, and report sections, supporting issue validation and organized documentation for quality review and examiner requests.
• Independently lead configuration-focused testing in a specialty, such as Cyber Ark/PAM
  , Active Directory architecture
  , firewalls
  , and segmentation
  ; or cloud security architecture/WAF
  , SIEM/XDR/SOAR
  , DLP
  , encryption/key management
  , or vulnerability evidence
  .

• At least 5 years of relevant IT audit, cybersecurity audit, technology risk, or related control experience, including experience coordinating audit fieldwork and guiding other auditors.
• Experience must include IT or cybersecurity operational audit work;
  general ITGC testing alone is not sufficient
  .
• Ability to independently lead configuration-focused audit testing in at least one area: (1)
  Cyber Ark/PAM
  , Active Directory architecture
  , firewalls
  , segmentation
  , or network security
  ; or (2)
  cloud security architecture/WAF
  , SIEM/XDR/SOAR
  , DLP
  , encryption/key management
  , or vulnerability management (experience with comparable tools is acceptable).
• Familiarity with official security guidance for Microsoft Azure
  , AWS
  , and Google Cloud
  , including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance, with the ability to locate and apply relevant guidance during planning and…