Hiring: Senior IT Auditor – SOC 2 / ISO 27001 / PCI DSS (QSA or QSA-track) Bengaluru | Full time | Hybrid | 4–6 yrs Atom Assurances is a licensed CPA firm that performs independent IT audits and attestation – SOC 2, SOC 3, ISO 27001, PCI DSS, HIPAA, GDPR, CCPA. We don’t implement controls, sell tooling or write client policies. We audit. 80+ lead auditors, 4,000+ audits, 11 years, clients in 40+ countries. We’re launching our PCI DSS assessment practice and hiring the people who will form its QSA core. What you’ll do Lead scoping with clients – boundaries, in-scope TSC categories or PCI DSS requirements, period, sampling, timelines Review system descriptions, control matrices and evidence from GRC platforms (Drata, Vanta, Sprinto, Secureframe) against TSC, ISO 27001 Annex A and PCI DSS v4.0.1 Perform and review control testing; draft and QA working papers, query lists and full SOC 2 / ISO 27001 reports and ROCs Be the client’s day-to-day audit contact with CTOs, CISOs and compliance leads Coach associates; contribute to methodology and internal QC Qualify (or re-qualify) as a PCI SSC QSA, sign ROCs and mentor Associate QSAs Required QSA status – one of:



current QSA; past QSA willing to re-qualify; or QSA-eligible and committed to training in the first cohort after joining (we sponsor training and requalification) QSA eligibility pairing: CISSP / CISM / CCSP AND CISA / CIA / IRCA ISMS Auditor 1+ yr each in application security, network security, systems security, IT security auditing, risk assessment 4–6 yrs in IT audit/attestation, 2+ yrs leading fieldwork (Big 4, mid-tier, specialist SOC 2/ISO firm, or fintech/SaaS internal IT audit) Have drafted SOC 2 or ISO 27001 audit reports, not just collected evidence Depth in AWS/GCP/Azure: IAM, segmentation, logging, encryption/KMS, vuln mgmt, CI/CD and change control – and how each is evidenced Clear written English; comfortable with multiple concurrent engagements Advantage: signed ROCs to your name; ISA or assessed-entity PCI experience; ISO 27001 LA, CRISC, CCAK. How we work Full-time, Bengaluru, hybrid (full-time is a PCI SSC requirement for QSA) Global clients – some early/late calls with US and EU time zones Firm-paid cert maintenance; fully sponsored QSA training, exam and annual requalification Path to Lead Auditor / Audit Manager and a named QSA on our PCI SSC listing Apply with your CV and a redacted sample of a report section or working paper you drafted

📌 Senior Audit Associate (Bengaluru)
🏢 Atom Assurances Services
📍 Bengaluru