Information Technology Internal Auditor

About JiBe

JiBe is a cloud-based fully integrated ERP system for the shipping industry. Our goal is to allow shipping companies to improve productivity, efficiency, and safety levels, while reducing costs. JiBe ERP enables increased automation and streamlining processes, creating pre-defined work flows and reducing the usage of email and paper.

Job Objectives:

JiBe is a cloud-based, fully integrated ERP system for the shipping industry. As a SaaS provider serving global shipping companies, our security and compliance certifications are a core commitment to our customers — ISO 27001 and SOC 2 are part of how we earn and keep their trust. The Internal IT Auditor owns JiBes internal audit and compliance activity: planning and running internal audits, keeping the company ready for external ISO 27001 and SOC 2 audits year-round, and making sure findings — from audits, assessments, and security incidents — are followed through to closure. You will work across IT, R&D, and DevOps, and act as the main point of contact for external auditors.

Job Responsibilities

Internal Audit & Control Testing

• Plan and execute the annual internal audit program: conduct internal audits against ISO 27001 and SOC 2 controls, document findings, and track remediation to closure.
• Perform control testing and gap assessments, collecting and organizing evidence to an external-audit standard.

External Audit & Certification Readiness

• Lead preparation and coordination for external audits (ISO 27001 certification and surveillance, SOC 2 Type II): audit scheduling, evidence collection, auditor liaison, and management of corrective actions.
• Maintain a year-round audit readiness posture and calendar, so external audits are a checkpoint rather than a scramble.

ISMS, Risk & Policy Management

• Maintain the ISMS documentation set — policies, procedures, Statement of Applicability, and risk register.
• Drive periodic risk assessments and treatment plans together with control owners across the company.

Security Assessments & Incident Follow-Up

• Coordinate periodic vulnerability assessments and penetration tests with IT and external vendors; validate scope, review results, and track remediation with the relevant teams.
• Review internal security incident reports, verify root-cause analysis and corrective actions, and follow up until closure.

Vendor & Customer Assurance

• Run vendor and third-party risk assessments as part of the procurement and vendor-review process.
• Support responses to customer security questionnaires and customer audits.

Reporting

• Report compliance posture, audit results, and open risks to management on a regular cadence.

Qualifications and Skills

• 3–6 years of experience in IT audit, GRC, or security compliance, preferably in a SaaS or software company.
• Hands-on experience with at least one full ISO 27001 and/or SOC 2 audit cycle — from preparation and evidence collection through the external audit itself.
• Working knowledge of risk assessment methodologies and control frameworks (ISO 27001/27002; familiarity with SOC 2 Trust Services Criteria).
• Familiarity with data protection regulations (e.g., GDPR) and their impact on a SaaS business.
• Excellent written and spoken English — the role produces audit reports, policies, and customer-facing responses.

Core Soft Skills

• Self-motivated, independent, and meticulous, with strong organizational skills and an eye for detail.
• Clear, precise writing — audit findings and policies that people can actually act on.
• Team player with good interpersonal skills — able to work with R&D, IT, and DevOps teams and gain cooperation without formal authority.

Nice to Have

• Experience with compliance automation platforms (e.g., Vanta, Drata, Scytale).
• Familiarity with application security concepts and vulnerability management processes.
• Experience in cloud environments (Azure / AWS) and understanding of cloud security controls.

Certifications (Preferred, Not Mandatory)

• CISA (Certified Information Systems Auditor).
• ISO 27001 Lead Auditor / Lead Implementer.