ZipRecruiter

Log In

2

Full Time Isms Lead Auditor Jobs (NOW HIRING)

Navan

Staff Security Analyst

Palo Alto, CA · On-site

$72K - $96K/yr

In this role, you'll manage our Information Security Management System (ISMS), lead internal and ... Serve as the primary point of contact for external auditors, manage audit schedules, define testing ...

Northern Base

IT Auditor - Houston, TX

Houston, TX · On-site

... Fulltime Must Have Technical/Functional Skill IT Audit, ITGC, SOX Compliance, ISO 27001 (ISMS ... T Audit Lead responsible for executing IT audit engagements. Perform assessment of ITGC and ISO ...

Intertek

Food Safety Auditor-Full Time

Boxborough, MA · On-site

Lead Auditor, reviews all team members' documentation for accuracy and completeness. Ensure all documents required by the respective standard are in place for presentation to the Registration Review ...

Intertek

Food Safety Auditor-Full Time

Boxborough, MA · On-site

Lead Auditor, reviews all team members' documentation for accuracy and completeness. Ensure all documents required by the respective standard are in place for presentation to the Registration Review ...

previous pagenext page

Showing results 21-40

All JobsIsms Lead Auditor JobsFull Time Isms Lead Auditor Jobs

Full Time Isms Lead Auditor information

See salary details

$32.5K

$102.9K

$147K

How much do full time isms lead auditor jobs pay per year?

As of Aug 7, 2026, the average yearly pay for full time isms lead auditor in the United States is $102,886.00, according to ZipRecruiter salary data. Most workers in this role earn between $80,500.00 and $132,500.00 per year, depending on experience, location, and employer.

What is the difference between Full Time Isms Lead Auditor vs Full Time Isms Auditor?

AspectFull Time Isms Lead AuditorFull Time Isms Auditor
CertificationsISO 19011 Lead Auditor, ISO 9001/14001/45001 certificationsISO 19011 Auditor, ISO 9001/14001/45001 certifications
Work EnvironmentLeads audit teams, plans audits, reports findingsPerforms audits, documents non-conformities, reports
ResponsibilitiesOversees audit process, ensures compliance, trains auditorsConducts audits, identifies issues, recommends improvements

The main difference is that a Full Time Isms Lead Auditor manages and oversees the audit process, while a Full Time Isms Auditor focuses on executing audits. Lead auditors have additional responsibilities like team leadership and planning, whereas auditors primarily perform the audit tasks. Both roles require similar certifications and work in the same industry environment.

More about Full Time Isms Lead Auditor jobs
What are the most commonly searched types of Isms Lead Auditor jobs? The most popular types of Isms Lead Auditor jobs are:
What job categories do people searching Full Time Isms Lead Auditor jobs look for? The top searched job categories for Full Time Isms Lead Auditor jobs are:
Full Time Isms Lead Auditor jobs near you
Infographic showing various Full Time Isms Lead Auditor job openings in the United States as of August 2026, with employment types broken down into 87% Full Time, 10% Part Time, and 3% Contract. Highlights an 91% Physical, 3% Hybrid, and 6% Remote job distribution, with an average salary of $102,886 per year, or $49.5 per hour.

Staff Security Analyst

Navan

Palo Alto, CA • On-site

$72K - $96K/yr

Full-time

Posted 9 days ago

Job description

We are looking for a Staff Security Analyst to take full ownership of our compliance architecture. You won't just maintain compliance-you'll scale and automate it to eliminate manual friction. In this role, you'll manage our Information Security Management System (ISMS), lead internal and external audits, and serve as the primary bridge between external regulators and our internal teams. If you excel at translating deep technical expertise into practical, automated solutions, this is your chance to shape our security ecosystem across the organization.
What You'll Do:
Compliance Program Leadership (Primary Focus)
  • Multi-Framework Compliance Management: Lead and execute compliance programs for PCI DSS, SOX (IT General Controls and Application Controls), ISO 27001, ISO 42001 (AI Management System), SOC 1 (Type I & II), and SOC 2 (Type I & II)
  • ISMS Operations: Run and continuously improve the Information Security Management System (ISMS), including risk treatment planning, internal audit programs, management reviews, and corrective action processes
  • Audit Coordination & Management: Serve as the primary point of contact for external auditors, manage audit schedules, define testing scopes, coordinate evidence requests, and facilitate audit readiness assessments
  • Risk Assessment & Adjustment: Perform risk assessments across controls, policies, and technical environments; conduct risk-adjusted analysis of control deficiencies and exceptions; develop risk treatment plans aligned with business objectives
  • Control Automation & Optimization: Partner with control owners across IT, Engineering, Finance, and Operations to identify automation opportunities; implement automated evidence collection, continuous control monitoring, and self-service compliance workflows
  • Regulatory Compliance Strategy: Monitor regulatory changes and emerging compliance requirements; assess applicability and impact; develop implementation roadmaps for new regulatory obligations

Control Framework & Testing
  • Control Owner Enablement: Work directly with technical and business control owners to design, implement, and automate security controls; provide guidance on control testing methodologies and evidence requirements
  • Control Testing Program: Establish and execute risk-based control testing schedules; perform detailed control testing including design effectiveness, operating effectiveness, and sampling methodologies
  • Gap Assessment & Remediation: Identify control gaps and deficiencies through testing and continuous monitoring; develop comprehensive remediation plans with clear timelines, ownership, and risk mitigation strategies
  • Evidence Management: Design and maintain centralized evidence repositories and compliance platforms (e.g., Vanta, Drata, OneTrust, Hyperproof, or similar GRC tools); ensure evidence quality, completeness, and auditability

Governance, Policy & Documentation
  • Policy Development & Maintenance: Create, review, and maintain information security policies, standards, procedures, and guidelines aligned with regulatory requirements and industry best practices
  • Unified Control Framework (UCF): Develop and maintain control mapping across multiple frameworks to identify overlapping requirements and optimize control implementation
  • Documentation Governance: Oversee the complete lifecycle of compliance documentation from creation through approval, publication, and retirement; maintain version control and change tracking
  • Compliance Reporting: Prepare executive-level compliance status reports, risk dashboards, and KPI metrics; communicate compliance posture to senior management, board, and audit committees

Cross-Functional Collaboration & Stakeholder Management
  • Executive Communication: Articulate complex compliance requirements and risk scenarios to C-level executives, board members, and non-technical stakeholders
  • Cross-Functional Partnership: Collaborate closely with Engineering, IT, Finance, Legal, People Ops, and Business Units to bridge control gaps and implement compliance solutions
  • Training & Awareness: Develop and deliver security compliance training programs for employees, contractors, and control owners; build compliance awareness throughout the organization

What We're Looking For:
Experience & Background
  • 6-8+ years of progressive experience in security governance, risk and compliance (GRC), information security auditing, or compliance program management
  • Demonstrated experience working directly with Big Four or external auditors through full audit cycles
  • Control automation experience: Proven success implementing automated evidence collection, continuous control monitoring, and compliance workflow automation
  • ISMS management: Hands-on experience running an Information Security Management System (ISO 27001 ISMS or equivalent)

Framework & Regulatory Knowledge
  • Deep expertise in PCI DSS (all 12 requirements, SAQ types, ROC processes, compensating controls)
  • Strong knowledge of SOX IT General Controls (ITGC) and Application Controls (e.g., access controls, change management, backup/recovery, segregation of duties)
  • Proficiency with ISO 27001:2022 and ISO 42001:2023 (AI Management System) frameworks
  • Hands-on experience with SOC 1 (SSAE 18/ISAE 3402) and SOC 2 (Trust Services Criteria) audit requirements
  • Working knowledge of security frameworks including NIST CSF, NIST SP 800-53, CIS Controls, or COBIT

Technical & Cloud Security
  • Cloud security controls: Deep understanding of cloud security architecture, identity and access management (IAM), network security, data protection, and logging/monitoring within AWS (Azure or GCP experience is a strong plus)
  • Control implementation: Practical knowledge of technical control implementation including encryption, secure configuration management, vulnerability management, and incident response
  • Security architecture: Ability to review and assess security architectures, data flows, and system designs from a compliance perspective

Tools & Technology
  • GRC platforms: Hands-on experience with compliance automation platforms (e.g., Vanta, Drata, OneTrust, Hyperproof, ServiceNow GRC, Archer, or similar)
  • Evidence collection automation: Experience implementing automated evidence collection using APIs, scripts, or integration platforms
  • Audit & assessment tools: Proficiency with vulnerability scanners, SIEM platforms, configuration management tools, and compliance scanning solutions

Education & Certifications
  • Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Systems, or related field
  • Certifications (one or more):
    • CISA (Certified Information Systems Auditor)
    • CISM (Certified Information Security Manager)
    • CISSP (Certified Information Systems Security Professional)
    • ISO 27001 Lead Auditor or ISO 27001 Lead Implementer
    • CCSP (Certified Cloud Security Professional) or CCSK (Certificate of Cloud Security Knowledge)
    • PCI ISA (Internal Security Assessor) or PCI QSA (Qualified Security Assessor)

Specialized Experience
  • Regulated markets: Prior experience with FedRAMP (Low/Moderate/High), GovRAMP, CMMC (Level 1-3), StateRAMP, or TX-RAMP authorization processes
  • Government & defense: Experience with NIST SP 800-171, DFARS compliance, or DoD authorization frameworks
  • Unified Control Framework (UCF): Demonstrated success building and maintaining unified or common control frameworks that map requirements across multiple standards
  • Consulting background: Previous experience with Big Four consulting firms (Deloitte, PwC, EY, KPMG) or specialized security/compliance consulting practices

The posted pay range represents the anticipated low and high end of the compensation for this position and is subject to change based on business need. To determine a successful candidate's starting pay, we carefully consider a variety of factors, including primary work location, an evaluation of the candidate's skills and experience, market demands, and internal parity.
For roles with on-target-earnings (OTE), the pay range includes both base salary and target incentive compensation. Target incentive compensation for some roles may include a ramping draw period. Compensation is higher for those who exceed targets. Candidates may receive more information from the recruiter.
Pay Range
$131,025-$291,300 USD
Navan logo

About Navan

Sourced by ZipRecruiter

Industry

Traveler accommodation

Company size

1,001 - 5,000 Employees

Headquarters location

Palo Alto, CA, US

Year founded

2015

Social media

Twitter

View All Navan Jobs

Apply