IT Auditor​/Auditor​/Internal Audit

The Staff IT Auditor leads second-line assurance for Relativity’s control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They are responsible for integrated, cross-functional IT control design and advise first-line on effective operationalization of controls. This role will be responsible for continuous testing of IT General Controls (ITGC) and the ongoing adaptation of Relativity’s Risk and Control Matrix (RCM) lifecycle.

Expected to act and serve cross-functionally as the subject matter expert on all aspects of IT risk assurance and possess deep domain knowledge across IT governance, risk and compliance.

• Expert level risk reasoning and decisioning knowledge, with demonstrable risk management acumen.
• Expert level IT control architecture and necessary technical depth to rationalize.
• Expert level risk assurance engineering and use of technology for continuous control validation.
• Capable systems thinker that solves complex problems creatively – GRC isn’t the office of “No,” we expand the possibility of “Yes.”
• You effectively translate strategic intent to tactical execution with a high level of autonomy and quality.

Set and maintain the information security policies and standards aligned to management’s control framework and set the standards that the first line of defense operate against. Continuously assessing the adequacy and effectiveness of the controls placed in operation.

Identifying and reporting risks with high fidelity risk reasoning and decisioning quality and providing gap analyses and remediation plans to design and implement controls and/or suggesting risk treatment plans.

Continuously monitor control performance, design optimization plans to first line of defense for control rationalization and continued alignment and adherence to standards.

Own the end-to-end process of tracking, reporting and accounting for control deficiencies and exceptions, gaps and weaknesses.

Own, update and report on the information security’s risk register to the CISO, management and other enterprise stakeholders on a quarterly basis.

Define, aggregate, and report risk metrics to information security leadership, other executive stakeholders and the board.

Serve as the subject matter expert related to the nature, timing and extent of IT controls aligned to standardized frameworks. Ensures control environment supports and enables organizational strategic outcomes and reduces audit lifecycle burden to accelerate innovation and maintain organizational agility. Collaborates with ERM to set IT risk appetite ensuring it is aligned with organizational risk appetite and thresholds.

Sets IT control architectural standards and defines the authoritative technical position for control architecture aligned with risk taxonomy.

Accountable for decisions that carry enterprise-wide audit, certification, and customer trust consequences.

Maintains an advanced fluency in information security standards, benchmarks, frameworks and regulatory guidance as you are responsible for the proactive interpretation of framework revisions, shifts in industry standards and changes in assessor/auditor testing requirements.

Collaborates with third line of defense, internal audit and relevant stakeholders to successfully execute enterprise-wide integrated audits (e.g., Performs independent analysis around information security’s maturation and capabilities aligned with standards. Leads diagnosis of complex, cross-system, and ambiguous control failures with minimal supervision and working effectively in unfamiliar architecture, holding competing hypotheses without premature commitment, and producing high fidelity analysis that withstands independent technical and auditor scrutiny without…