Job Summary
The Internal IT Auditor is a hands-on technical role focused on evaluating, monitoring, and auditing the organization’s technical systems, infrastructure, and core operating applications. This position ensures that engineering configurations and technical architecture satisfy the requirements of our Information Security Management
System (ISMS), ISO/IEC 27001/2022, and PCI DSS v4.0.
Operating as an Internal Security Assessor (ISA), this individual bridges the gap between pure policy and technical implementation, verifying system controls at the root level before formal external validation.
Key Responsibilities
Technical ISMS & System Auditing: Audit system configurations, cloud architectures (OCI/AWS/Azure), operating systems, and network parameters to ensure continuous alignment with ISO 27001/2022 and internal security manuals (ISMs).
PCI DSS Internal Assessment (ISA Role): Perform routine internal audits of the
Cardholder Data Environment (CDE). Maintain data flow and network segmentation diagrams, review daily security logs, and validate network boundaries as a certified or equivalent Internal Security Assessor (ISA).
Control Testing & Technical Validation: Go beyond paperwork to verify active technical controls: audit Multi-Factor Authentication (MFA) enforcement, Role
Based Access Control (RBAC) consistency, vulnerability patch cycles, and endpoint protection rules.
Biometric & Identity Access Audit: Evaluate specialized identity verification controls—including biometric hardware and enrollment software workflows (leveraging ISO/IEC 20027 guidelines where applicable —to confirm highly secure physical and logical entry points.
Cross-Framework Mapping: Maintain a unified technical control crosswalk to eliminate duplicate audit tasks by mapping system security configurations simultaneously to PCI DSS controls and ISO 27002 clauses.
Evidence Gathering & Log Inspection: Extract and interpret evidence straight from technical systems (e.g., SIEM logs, firewall rulesets, encryption keys, and pipeline vulnerability scans).
Key qualifications:
Bachelor’s degree in IT, Computer Science, Cybersecurity, or an equivalent technical field.
4+ years of demonstrable experience auditing IT systems, verifying infrastructure security, or supporting an active corporate ISMS.
Information Security Certifications are highly valued:
Active or prior PCI ISA or QSA designation.
ISO 27001 Internal Auditor / Lead Auditor.
CompTIA Security+, CISA or CEH.
Similar open roles
- Pre Sales Specialist (GCP) at AbacusAbacus · Nairobi
- Investment Manager – Airbel Ventures at International Rescue CommitteeInternational Rescue Committee · Nairobi
- Enterprise Development OfficerEquity Bank Kenya · Nairobi
- Finance and Administration Intern at Brooke East AfricaBrooke East Africa · Nairobi
- Incubation AgentJumia · Nairobi
- Coastal Dishes ChefNexus Staffing Solutions · Nairobi
Get this application ready in minutes.
This employer takes applications on jobwebkenya.com. Sign up, upload your CV, and RezSync tailors your CV and cover letter to this role and gives you the link to submit it. For roles that take email applications, RezSync applies for you.
Prefer to apply yourself? Apply on jobwebkenya.com