External Lead Auditor, ISO ; Dutch​/English

Department Audit Delivery

Reports to Director of Audit Delivery

Location Remote

Languages Dutch / English

• University-level education or equivalent professional training in a relevant field, with practical experience in IT (information technology) and information security.
• Active ISO 27001 Lead Auditor certification and at least two years of third-party ISO 27001 audit experience.
• Professional written and spoken fluency in Dutch / English.
• Evidence of at least 10 ISMS (information security management system) on-site audit days within the past three years, working with a certification body and monitored by a qualified ISMS (information security management system) evaluator.
• The evaluated experience must include an initial certification audit covering Stage 1 and Stage 2, or a recertification audit, plus a surveillance audit, including document review, risk assessment and implementation review, and reporting.
• This experience must be with a certification body. Internal and supplier audits do not count towards the required third-party audit days.
• Ability to lead audit teams, conduct technical interviews and write clear findings supported by evidence.

• Experience auditing cloud services, software development or managed IT (information technology) services.
• Experience conducting remote certification audits with teams in different locations.
• Experience auditing additional information security standards.

Complade is a Standards Council of Canada (SCC)-accredited certification body. In this role, you will lead independent ISO/IEC 27001 certification audits in Dutch / English. You will report to the Director of Audit Delivery and work directly with clients to review evidence, explain findings and complete audit reports. Complade’s portal brings together audit plans, evidence, findings and reports.

• Plan and lead Stage 1, Stage 2, surveillance and recertification audits in Dutch / English.
• Review ISMS (information security management system) documentation, risk assessments, control implementation and evidence of effectiveness.
• Conduct opening and closing meetings, interview client teams and coordinate audit team assignments.
• Record findings and prepare audit reports within agreed timelines.
• Review corrective actions and supporting evidence, and complete follow-up assessments when required.
• Submit audit records to the independent Certification team and respond to review questions.
• Protect client information, disclose conflicts of interest and maintain impartiality throughout each assignment.

A lead-auditor qualification alone does not authorize someone to lead Complade audits. Our evaluation and authorization process follows these steps.

• Interviews. Shortlisted candidates discuss their technical knowledge, audit experience and approach to evidence. Candidates who do not yet meet the interview criteria may be considered for an internship.
• Competence-gap assessment. After a successful interview, we assess the competencies you have demonstrated and identify any missing credentials, training or experience. Complete the agreed development work before progressing.
• Complade onboarding and exam. Complete training in Complade’s audit methods, portal, reporting, confidentiality and impartiality requirements, then pass the onboarding exam.
• Three audits as a team member. Take part in three audits as a member of the audit team. Your work is reviewed as part of the evaluation process.
• Three witnessed lead audits. Lead three audits while a qualified evaluator observes and assesses your work. These are Complade competence evaluations; they do not mean that an accreditation-body assessor attends each audit.
• Final interview and authorization. Complete the final interview and competence review. Successful candidates receive Complade auditor authorization for three years, within the activities for which they have demonstrated competence. Authorization is subject to ongoing monitoring and review before renewal.

The three team-member audits and three witnessed lead audits are Complade evaluation steps. They do not replace applicable education, experience, audit-day and competence requirements. Complade authorization is separate from an individual professional certification.