First American Title Insurance Co offers a strong total rewards package alongside hybrid work in Santa Ana, CA. This role supports day-to-day delivery of technology and cybersecurity audit work, with opportunities to lead configuration-focused testing and help shape evidence-based conclusions for management review. The pay range for this position is $97,700.00 to $130,300.00 annually, with base pay determined by factors such as job-related knowledge, skills, experience, business requirements, and geographic location.
What you will do
You will lead the day-to-day planning and fieldwork for assigned technology and cybersecurity audits, including walkthroughs, risk and control mapping, test procedures, sampling, and work allocation. You will coordinate milestones and provide status reporting as you guide auditors through procedures that produce traceable, evidence-based conclusions for Manager review.
- Partner with the Manager to refine audit objectives and scope, identifying dependencies, system boundaries, shared services, relevant regulations, and program components that could leave material risks unaddressed.
- Run day-to-day discussions with control owners, technical SMEs, and project stakeholders, including walkthroughs and clarification of evidence requests.
- Guide Staff auditors on completing test procedures, collecting and validating evidence, documenting results, and following up on exceptions.
- Review workpapers for accuracy, traceability, and alignment with the approved test approach.
- Execute assigned procedures such as process walkthroughs, control assessment, population validation, sample selection, evidence inspection, reperformance, and follow-up testing.
- Perform configuration-focused testing across technology and security control areas, including security operations, incident response, endpoint and network security, data protection, penetration testing, application security, vulnerability and patch management, IAM, cloud, IT operations, change management, Secure SDLC, and business continuity/disaster recovery.
- Inspect security-technology configurations and supporting evidence, comparing sampled settings and rules to approved baselines and requirements, and assessing logging, monitoring, access, changes, encryption, certificates, and documented exceptions as applicable.
- Evaluate evidence for relevance, reliability, completeness, and consistency with control objectives; identify gaps, contradictory information, or scope limitations and raise them promptly with the Lead.
- Document procedures, evidence, sampling details, results, exceptions, and conclusions in clear, traceable workpapers that meet Internal Audit quality standards.
- Analyze exceptions for cause, impact, extent, and possible compensating controls, supporting observations and practical recommendations.
- Use data analysis, scripts, and audit tools where appropriate to validate populations, identify anomalies, and improve testing coverage.
- Help prepare status updates, report content, issue validation, and examination support materials; incorporate review comments and maintain organized audit files.
- Draft audit findings, recommendations, management responses, and report sections, supporting issue validation and organized documentation for quality review and examiner requests.
- Independently lead configuration-focused testing in a specialty, such as CyberArk/PAM, Active Directory architecture, firewalls, and segmentation; or cloud security architecture/WAF, SIEM/XDR/SOAR, DLP, encryption/key management, or vulnerability evidence.
What you bring
- At least 5 years of relevant IT audit, cybersecurity audit, technology risk, or related control experience, including experience coordinating audit fieldwork and guiding other auditors.
- Experience must include IT or cybersecurity operational audit work; general ITGC testing alone is not sufficient.
- Ability to independently lead configuration-focused audit testing in at least one area: (1) CyberArk/PAM, Active Directory architecture, firewalls, segmentation, or network security; or (2) cloud security architecture/WAF, SIEM/XDR/SOAR, DLP, encryption/key management, or vulnerability management (experience with comparable tools is acceptable).
- Familiarity with official security guidance for Microsoft Azure, AWS, and Google Cloud, including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance, with the ability to locate and apply relevant guidance during planning and configuration testing.
- Strong working knowledge of audit methodology, risk and control assessment, sampling, evidence evaluation, workpaper documentation, and issue development.
- Strong analytical, written, and verbal communication skills, with the ability to manage assigned testing with limited day-to-day direction.
Technologies you may work with
- CyberArk, PAM, Active Directory
- SIEM, XDR, SOAR, DLP, WAF, Secure SDLC
- Microsoft Azure, AWS, Google Cloud
- AuditBoard, Power BI, ServiceNow, Jira, SailPoint
- NIST CSF, NIST SP 800-series guidance, GLBA, PCI DSS, OWASP, CIS Benchmarks
Benefits
- Medical, dental, vision
- 401k
- PTO and paid sick leave
- Employee stock purchase plan
Preferred experience
- Strongly preferred: experience testing controls in audits of Network Security, Security Operations, Data Security, Data Protection, Data Privacy, Offensive Security, or Vulnerability Management.
- Valued: banking or financial-services experience, with exposure to GLBA, Interagency Guidelines, SWIFT CSP, PCI DSS, OWASP, CIS Benchmarks, NIST CSF, or NIST SP 800-series guidance.
- Valued: relevant IT or cybersecurity coursework, professional training, or hands-on experience.
- Plus: exposure to CTI, cloud service management (AWS, Azure, or GCP), or PKI and certificate management.
- Helpful: familiarity with AuditBoard, Power BI, ServiceNow, Jira, or SailPoint.
Los Angeles County Fair Chance and Criminal History Review: Note that certain statements apply to candidates who will be working from an unincorporated area within Los Angeles. First American will consider all qualified applicants, including those with arrest or conviction records, consistent with applicable state and local laws. First American intends to conduct a review of an applicant’s criminal history in connection with a conditional offer. First American reasonably believes criminal history may have a direct, adverse, and negative relationship with material job duties for this position, potentially resulting in withdrawal of the conditional offer. These duties include handling confidential, proprietary, or trade secret information belonging to First American or its customers, administrating or facilitating financial transactions, and meeting customer-imposed criminal history requirements.
Pay range: $97,700.00 - $130,300.00 annually. This hiring range is a reasonable estimate of the base pay range for this position at the time of posting, and pay is based on factors that may include job-related knowledge, skills, experience, business requirements, and geographic location.
