Information technology internal auditor

About Ji Be
Ji Be is a cloud-based fully integrated ERP system for the shipping industry. Our goal is to allow shipping companies to improve productivity, efficiency, and safety levels, while reducing costs. Ji Be ERP enables increased automation and streamlining processes, creating pre-defined work flows and reducing the usage of email and paper.
Job Objectives:
Ji Be is a cloud-based, fully integrated ERP system for the shipping industry. As a Saa S provider serving global shipping companies, our security and compliance certifications are a core commitment to our customers — ISO 27001 and SOC 2 are part of how we earn and keep their trust. The Internal IT Auditor owns Ji Be's internal audit and compliance activity: planning and running internal audits, keeping the company ready for external ISO 27001 and SOC 2 audits year-round, and making sure findings — from audits, assessments, and security incidents — are followed through to closure. You will work across IT, R&D, and Dev Ops, and act as the main point of contact for external auditors.
Job Responsibilities
Internal Audit & Control Testing
Plan and execute the annual internal audit program: conduct internal audits against ISO 27001 and SOC 2 controls, document findings, and track remediation to closure.
Perform control testing and gap assessments, collecting and organizing evidence to an external-audit standard.
External Audit & Certification Readiness
Lead preparation and coordination for external audits (ISO 27001 certification and surveillance, SOC 2 Type II): audit scheduling, evidence collection, auditor liaison, and management of corrective actions.
Maintain a year-round audit readiness posture and calendar, so external audits are a checkpoint rather than a scramble.
ISMS, Risk & Policy Management
Maintain the ISMS documentation set — policies, procedures, Statement of Applicability, and risk register.
Drive periodic risk assessments and treatment plans together with control owners across the company.
Security Assessments & Incident Follow-Up
Coordinate periodic vulnerability assessments and penetration tests with IT and external vendors; validate scope, review results, and track remediation with the relevant teams.
Review internal security incident reports, verify root-cause analysis and corrective actions, and follow up until closure.
Vendor & Customer Assurance
Run vendor and third-party risk assessments as part of the procurement and vendor-review process.
Support responses to customer security questionnaires and customer audits.
Reporting
Report compliance posture, audit results, and open risks to management on a regular cadence.
Qualifications and Skills
3–6 years of experience in IT audit, GRC, or security compliance, preferably in a Saa S or software company.
Hands-on experience with at least one full ISO 27001 and/or SOC 2 audit cycle — from preparation and evidence collection through the external audit itself.
Working knowledge of risk assessment methodologies and control frameworks (ISO 27001/27002; familiarity with SOC 2 Trust Services Criteria).
Familiarity with data protection regulations (e.g., GDPR) and their impact on a Saa S business.
Excellent written and spoken English — the role produces audit reports, policies, and customer-facing responses.
Core Soft Skills
Self-motivated, independent, and meticulous, with strong organizational skills and an eye for detail.
Clear, precise writing — audit findings and policies that people can actually act on.
Team player with good interpersonal skills — able to work with R&D, IT, and Dev Ops teams and gain cooperation without formal authority.
Nice to Have
Experience with compliance automation platforms (e.g., Vanta, Drata, Scytale).
Familiarity with application security concepts and vulnerability management processes.
Experience in cloud environments (Azure / AWS) and understanding of cloud security controls.
Certifications (Preferred, Not Mandatory)
CISA (Certified Information Systems Auditor).
ISO 27001 Lead Auditor / Lead Implementer.