Information Security Auditor - South Africa

Location: South Africa (Remote)

Salary: R450 000 - R650 000 per annum

About Cognisys

Cognisys is a cybersecurity consultancy helping organisations strengthen their security posture through Penetration Testing, GRC Consulting and Managed Security services. We are a small but mighty team working with clients across more than 30 countries, delivering practical security solutions that make a measurable difference.

The Opportunity

As an Information Security Auditor, you will assess and evaluate the effectiveness of information security controls across a range of clients and industries. You'll work with client stakeholders to review security practices, gather and analyse evidence, identify control weaknesses and assess alignment with recognised security frameworks and standards.

This role is suited to someone with a solid understanding of information security, risk and compliance, who enjoys investigating how security controls operate in practice, identifying areas of risk and producing clear, evidence-based audit findings. You'll work alongside experienced security professionals while developing your technical audit and assessment capabilities.

What You'll Be Doing

Audit Delivery & Assessment

• Conduct information security audits, control assessments and compliance reviews across a range of clients and industries.

• Assess the design, implementation and operating effectiveness of information security controls.

• Review client environments, processes and supporting documentation to evaluate security practices.

• Gather, examine and validate evidence to support audit findings and conclusions.

• Identify control deficiencies, non-conformities and potential security risks.

• Assess client alignment with frameworks and standards such as ISO 27001, SOC 2, NIST and related requirements.

• Support internal and external audit activities, including certification and assurance assessments.

Technical & Risk Evaluation

• Evaluate technical and organisational security controls, including access management, asset management, vulnerability management, incident response and business continuity.

• Review policies, procedures, risk registers and other governance documentation.

• Assess whether security controls are appropriately implemented and operating as intended.

• Analyse identified weaknesses and determine their potential impact on the organisation's security posture.

• Develop clear, evidence-based audit findings and practical recommendations.

• Follow up on remediation activities and assess whether identified issues have been appropriately addressed.

Quality & Professional Standards

• Produce accurate, objective and high-quality audit reports and supporting documentation.

• Maintain clear audit trails and appropriate evidence records.

• Follow established audit methodologies, procedures and internal quality standards.

• Manage assigned audit activities, priorities and deadlines effectively.

• Maintain independence, professional judgement and attention to detail throughout the audit process.

• Stay informed about emerging cybersecurity risks, threats, controls and industry practices.

About You

You're naturally curious, analytical and detail-oriented, with a genuine interest in understanding how organisations manage and protect their information security environments. You enjoy investigating how controls work in practice, asking the right questions and identifying gaps that others might overlook.

You're comfortable working with different stakeholders, gathering evidence and challenging findings constructively. You take pride in producing accurate, objective work and can communicate technical risks and audit findings in a clear, practical way.

You're also someone who takes ownership, enjoys learning and developing your technical expertise, and understands the importance of balancing thoroughness with practical business considerations.

Essential Skills & Experience

• 2–5 years' experience in information security, IT auditing, cybersecurity, risk or compliance-related roles.

• Practical knowledge of at least one recognised framework or standard, such as ISO 27001, SOC 2, NIST or similar.

• Experience assessing security controls, reviewing evidence or supporting audit and assurance activities.

• Understanding of information security principles, technical controls and risk management.

• Strong analytical skills and the ability to investigate issues, identify weaknesses and draw evidence-based conclusions.

• Excellent written communication skills, particularly when documenting findings and preparing reports.

• Confidence engaging with technical and non-technical stakeholders.

• Strong organisational skills and the ability to manage multiple audit activities and deadlines.

Desirable Skills & Experience

• Previous experience conducting IT, information security or cybersecurity audits.

• Exposure to external audits, certification assessments or independent assurance engagements.

• Experience with GRC platforms such as Vanta.

• Familiarity with technical security domains such as identity and access management, network security, vulnerability management and incident response.

Certifications

Relevant certifications are advantageous but not essential. These may include:

• ISO 27001 Lead Auditor.

• Certified Information Systems Auditor (CISA).

• Certified Information Security Manager (CISM).

• CompTIA Security+.

• Certified in Risk and Information Systems Control (CRISC).

• Other relevant information security or auditing qualifications.

What Success Looks Like

• Conducting thorough and structured information security audits and assessments.

• Evaluating the design and effectiveness of security controls against recognised frameworks and standards.

• Identifying control gaps, weaknesses and areas of potential risk.

• Gathering, reviewing and validating audit evidence to support findings and conclusions.

• Producing accurate, well-structured audit reports with clear findings and recommendations.

• Communicating audit outcomes effectively to technical and non-technical stakeholders.

• Managing audit activities, documentation and deadlines while maintaining quality and consistency.

Why Join Us?

At Cognisys, you will be part of a collaborative and innovative team that values your input and shares support. You'll have the opportunity to work on challenging projects that make a real impact for our clients. We'd love to hear from you if you want to challenge, lead and innovate! We're not just about the work; we're about the people. Join a team where innovation is celebrated, and your contributions are valued. We foster a collaborative environment where fresh ideas thrive, and professional growth is encouraged.

What we Offer:

• Annual Leave: 25 days per year plus 12 South African public holidays.

• Additional Leave: 1 day of paid leave for your Birthday.

• Health & Wellbeing: Individual healthcare insurance plan and access to an employee mental health and wellbeing platform.

• Professional Development: £2,000 annual training budget to support your continued learning and career growth.

• Referral Bonus: help to grow our team and earn up to £2,000 per successful referral.

Applications

We’re always happy to help with questions, but to keep our process fair for everyone, we’re unable to accept applications via email—please apply directly through the job advert page.

Please feel free to reach out to Andrea, our Talent Acquisition Lead, if you would like any further information, to discuss accessibility requirements, or if you require this information provided in an alternative format – andrea.smith@cognisys.group

We welcome applications from candidates from a range of diverse backgrounds and can make various reasonable adjustments to consider individual needs.