Junior Information Security Auditor

Most days involve executing a piece of an audit plan — pulling system samples, interviewing IT owners, testing whether controls operate as documented, and writing up findings. You'll often work from a framework like NIST 800-53, ISO 27001, or SOC 2 trust criteria, walking through evidence with engineers and capturing gaps. Senior auditors generally own the engagement; you handle the testing scope assigned to you.

What's harder than people expect is the diplomatic edge — IT teams don't love auditors, and finding real issues without making enemies takes practice. Variance matters: Big Four work tends to be SOC 2 and SOX-heavy with long client rosters; internal audit at a bank or healthcare org goes deeper into a single environment; security-focused consulting can lean more technical. CISA, CISSP, or CIA certifications shape upward mobility.

People who tend to thrive here are detail-obsessed, comfortable asking awkward questions, and able to translate technical findings into business risk language. If you want hands-on engineering or fast iteration, the documentation-heavy pace can feel slow. If you find satisfaction in mapping how secure an organization actually is versus how secure it claims to be, the work tends to be intellectually steady and well-compensated.