> Markdown version of [/jobs/ext/2448683-cyber-security-internal-auditor](https://www.wearedevelopers.com/jobs/ext/2448683-cyber-security-internal-auditor). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Security Internal Auditor

- **Company:** Sita
- **Location:** Barcelona, Spain (Remote available)
- **Contract:** Permanent contract
- **Skills:** Cloud Computing Security, Control Objectives for Information and Related Technology (COBIT), Cyber Security, Identity and Access Management, Log Analysis, Systems Development Life Cycle, Privacy Controls, IT General Controls (ITGC), Software Security, Data Analytics, Vulnerability Analysis
- **Published:** August 15, 2026
- **Apply:** https://www.jobleads.com/es/job/e56564ee77482fb5e316ddb4f7fb6035e

## About the Role

* 3 years of experience in external/internal cyber, IT, and privacy auditing
 * Experience performing end-to-end audits independently
 * Strong understanding of cybersecurity and IT controls
 * Experience with technical audit techniques (not only policy-level reviews)
 * Familiarity with frameworks such as ISO 27001, NIST, CIS, COBIT, GDPR, NIS2
 * Background in an audit environment (e.g. audit firm or internal audit team)
 * Ability to communicate effectively with senior stakeholders, including leadership level, * ISO 27001 Lead Auditor or similar certification (e.g. CISM)
 * Exposure to privacy topics alongside cybersecurity

## Description

The purpose of this role is to perform Cyber Security, IT and Privacy audits of SITA corporate procedures processes and sites throughout the world and to prepare factual audit reports and communications informing management and stakeholders of risk areas and issues., Perform independent cyber security, IT and Privacy audits in accordance with the audit schedule approved by the Audit and Risk Management Committee and hence prepare for independent cyber security, IT and Privacy audits and field work with the purpose of evaluating (but not limited to):

 * Cyber Security, IT and Privacy Policies, Standards and Procedures
 * Cyber, IT and Privacy governance and operating model
 * Cyber Security, IT and Privacy risk management
 * Identity & access management (IAM)
 * Network and infrastructure security
 * Cloud security
 * Application security and SDLC
 * Data protection and privacy controls
 * Incident response and cyber resilience

In order to perform the above, the candidate must demonstrate ability to:

 * Perform end-to-end audit activities: planning, fieldwork, testing, documentation, and reporting
 * Apply data-driven and technical audit techniques (configuration reviews, log analysis, vulnerability assessment review, etc.)
 * Assess the design, implementation and and operating effectiveness of cybersecurity, IT anmd Privacy controls
 * Evaluate alignment with recognized frameworks and standards (e.g. NIST CSF, ISO 27001, CIS, COBIT, NIS2, GDPR)
 * Identify control gaps, weaknesses, and root causes
 * Assess management's remediation plans for adequacy, sustainability, and timeliness
 * Assess compliance with Internal policies, Regulatory and contractual cyber requirements
 * Provide assurance over third-party and supply-chain cyber, IT and Privacy risk management
 * Present audit results to senior management and EMT
 * Track and validate remediation actions, including follow-up testing where required


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [PySpark - Combining Machine Learning & Big Data](https://www.wearedevelopers.com/videos/44-pyspark-combining-machine-learning-big-data)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Progressive Delivery in Kubernetes](https://www.wearedevelopers.com/videos/949-progressive-delivery-in-kubernetes)
- [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [5 Best Emerging Tech Cities in Europe](https://www.wearedevelopers.com/magazine/361-5-best-emerging-tech-cities-in-europe)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)