[Hiring] Senior Technology Risk & Audit Specialist @Picus

Role Description

Most traditional auditor roles ask you to prove a company is secure at least once a year. At Picus, continuous security validation is our product. We are seeking a Senior Technology Risk & Audit Specialist to strengthen our security governance, risk, and compliance capabilities at scale. In this role, you will:

• Run assurance the way our customers run security: continuously, with evidence, and side-by-side with engineering teams.
• Own our global certification programs.
• Act as a strategic advisor to our technology teams.
• Help govern the AI agents at the heart of our platform.
• Shape scalable and risk-aware processes in a cloud-native and AI-driven environment.
• Be the person teams come to before they build, not after.

Qualifications

• 6+ years of hands-on experience in IT audit, information security, risk and compliance management, preferably within a SaaS, cloud-native, or fast-growing technology environment.
• Proven ability to evaluate software engineering processes from an audit and assurance perspective, covering CI/CD pipeline controls, secure development practices, vulnerability management, software supply chain security, and SBOM governance.
• Technical fluency in cloud infrastructure, IAM, SIEM, and CI/CD pipelines.
• Deep, hands-on experience with ISO/IEC standards (particularly 27001 and 27701), SOC 2 Type 2 and NIST frameworks.
• The ability to turn international standards into practical, scalable processes.
• Practical understanding of international privacy regulations (e.g., GDPR, KVKK, CCPA) and third-party risk management (TPRM) practices.
• Clear written and spoken English; ability to write understandable policies and advise cross-functional stakeholders.
• ISO/IEC 27001, 22301, 27701, 20000-1 and 42001 LA certifications (nice to have).
• ISACA certifications such as CISA (most preferred), CISM, or CRISC, AAIA, AAISM, or AAIR (nice to have).
• Hands-on experience with SOC 2, NIST, and CSA STAR reporting frameworks (nice to have).
• Team spirit that we value the most!

Requirements

• Plan and execute risk-based IT and internal audits, focusing on secure SDLC, software engineering processes, cloud infrastructure, and AI security domains.
• Evaluate and enhance the effectiveness of security and governance controls.
• Manage audit and security vulnerability findings end-to-end.
• Lead and oversee global compliance programs (ISO/IEC 27001, 22301, 27701, 20000-1, SOC 2, NIST CSF, CSA STAR).
• Actively support the Third-Party Risk Management (TPRM) program.
• Define and track key audit and compliance metrics.
• Assess the risk and privacy impact of emerging technologies (AI, ML, and automation).

Benefits

• Fascinating work in a fast-growing cybersecurity segment.
• Unlimited opportunity for career development.
• Global exposure working with customers around the world.
• Be part of a global remote team.

Company Description

Picus Security is an exposure validation company. Our platform proves what attackers can exploit and what your defenses stop, turning every exposure into a defensible decision. The Picus Platform spans Autonomous Penetration Testing, Exposure Validation, and Breach and Attack Simulation, unified by Picus Swarm, a swarm of AI agents that runs the whole validation loop continuously.