A specialist auditing information security controls — examining how the organization protects data, who has access, how incidents are detected and handled, and where security gaps could expose the business. The audit lens on cybersecurity.
Most days tend to involve controls testing, evidence review, interviews with IT and security teams, and the documentation that supports findings. You'll often test access controls, change management, vulnerability management, incident response, and data protection programs — producing findings that map to frameworks like NIST CSF, ISO 27001, SOC 2, or PCI DSS. Engagement cadence varies by employer.
The variance between settings is real — internal audit shops at large enterprises have specialized IT and security auditors; Big Four and second-tier audit firms run SOC 2, PCI, ISO certification engagements; consulting firms offer security assessments and program work; regulators audit security at financial institutions and critical infrastructure. Technical credibility with security operations matters — auditors who can talk specifics get further.
People who tend to thrive here are comfortable with deep systems thinking, patient with the documentation requirements of audit work, and capable of bridging audit and security cultures. CISA is the dominant credential, with CISSP, CISM, CRISC also common. The work tends to offer strong demand and broad career paths, with the trade-off being the constant evolution of the underlying technology — for those who enjoy the security-and-audit intersection, the work compounds in value as institutional knowledge grows.
Where this role sits in the broader career landscape — and where it can take you.
Roles like this one sit within a broader occupational category. The numbers below reflect that full landscape — helpful for context, but your specific experience will depend on level, specialty, and where you work.
A specialist auditing information security controls — examining how the organization protects data, who has access, how incidents are detected and handled, and where security gaps could expose the business. The audit lens on cybersecurity.
Median pay for an Information Security Auditor is about $109K nationally, with the field ranging roughly from $53K to $177K depending on experience, employer, and metro (BLS).
Core skills for this role include Reading Comprehension, Critical Thinking, Active Listening, Monitoring, and Writing.
Most people in this role hold a bachelor's degree.
Employment in this field is projected to grow about 8.2% through 2034, with roughly 439,380 people working in it today (BLS).
Closely related roles include Junior Information Security Auditor, Senior Information Security Auditor, and Security Specialist.
Truest gives you tools to understand your strengths, explore roles that fit, and plan your next move.
Explore Truest career tools