[Hiring] ISO 27001 Internal Auditor @Secfix

Role Description

We're hiring an ISO 27001 Internal Auditor to own our internal audits end to end. You stay independent from the implementation work. You audit what a customer has built, review their evidence on the Secfix platform, and give them a clear report before their external audit. You assess, you find what is missing, and you tell them in plain language exactly what to do about it. This is a hands-on individual contributor role with full ownership of a function customers trust us with.

What You'll Do:

• Own internal audits for our customers end to end, from kickoff through to the final report they take into their external audit.
• Review and sample evidence on the Secfix platform and assess it against the relevant ISO 27001 controls.
• Run the customer calls and walk customers through your findings and any non-conformities.
• Catch the non-conformities that matter, including the easy ones, so nothing avoidable surfaces later in an external audit.
• Write findings a non-technical founder can act on: what is missing, why it matters, and what to do next.
• Keep several audits moving at once and keep every one on schedule.
• Stay neutral to the implementation and hold a clean line between auditing and helping.
• Learn our other frameworks (TISAX, ISO 42001) and help build a repeatable audit structure for them.
• Help improve framework content on the platform, including evidence examples and guidance.
• Share structured product feedback when you spot recurring issues in the platform.

Qualifications

• Up to 2 years of information security background.
• Hands-on ISO 27001 internal audit experience, with at least 10+ internal audits you have personally run.
• A PECB ISO 27001 Lead Auditor certification or a direct equivalent.
• Direct experience auditing inside a modern GRC platform.
• Clear, concrete written and spoken English, with the ability to explain complex requirements simply.

Requirements

• Experience auditing or implementing TISAX, ISO 42001, NIS2 or SOC 2 (nice-to-have).
• Experience at an early-stage startup (Seed to Series B) (nice-to-have).
• Exposure to a modern SaaS product and cross-functional work with product teams (nice-to-have).

Benefits

• 100% remote work with a virtual office in Gather.
• Industry-competitive local salaries. We pay local rates that are at or above the market.
• Generous equity package – we’re all owners of Secfix and beneficiaries of our collective success.
• We are backed by top VCs and accelerators and have direct access to world-class mentors.
• €1,000 annual personal development budget.
• Home office budget and access to co-working spaces.
• 26 days holiday + local public holidays.
• Comprehensive health coverage.
• Annual retreat to build connections and inspire ideas (this year we’re headed to Alicante!).
• Company-wide events to build relationships and have some fun!
• Latest tech equipment (MacBook, monitors, headphones).

Interview Process

• 45 min - Intro call with Talent team.
• Take-home Assessment.
• 1.5hr Assessment review and interview with Compliance Team.
• 45 min - Final Founder Interview with CTO.