Hiring: Senior IT Auditor – SOC 2 / ISO 27001 / PCI DSS (QSA or QSA-track)

Bengaluru | Full-time | Hybrid | 4–6 yrs

Atom Assurances is a licensed CPA firm that performs independent IT audits and attestation – SOC 2, SOC 3, ISO 27001, PCI DSS, HIPAA, GDPR, CCPA. We don’t implement controls, sell tooling or write client policies. We audit. 80+ lead auditors, 4,000+ audits, 11 years, clients in 40+ countries.

We’re launching our PCI DSS assessment practice and hiring the people who will form its QSA core.

What you’ll do

Lead scoping with clients – boundaries, in-scope TSC categories or PCI DSS requirements, period, sampling, timelines

Review system descriptions, control matrices and evidence from GRC platforms (Drata, Vanta, Sprinto, Secureframe) against TSC, ISO 27001 Annex A and PCI DSS v4.0.1

Perform and review control testing; draft and QA working papers, query lists and full SOC 2 / ISO 27001 reports and ROCs

Be the client’s day-to-day audit contact with CTOs, CISOs and compliance leads

Coach associates; contribute to methodology and internal QC

Qualify (or re-qualify) as a PCI SSC QSA, sign ROCs and mentor Associate QSAs

Required

QSA status – one of:



current QSA; past QSA willing to re-qualify; or QSA-eligible and committed to training in the first cohort after joining (we sponsor training and requalification)

QSA eligibility pairing: CISSP / CISM / CCSP AND CISA / CIA / IRCA ISMS Auditor

1+ yr each in application security, network security, systems security, IT security auditing, risk assessment

4–6 yrs in IT audit/attestation, 2+ yrs leading fieldwork (Big 4, mid-tier, specialist SOC 2/ISO firm, or fintech/SaaS internal IT audit)

Have drafted SOC 2 or ISO 27001 audit reports, not just collected evidence

Depth in AWS/GCP/Azure: IAM, segmentation, logging, encryption/KMS, vuln mgmt, CI/CD and change control – and how each is evidenced

Clear written English; comfortable with multiple concurrent engagements

Advantage: signed ROCs to your name; ISA or assessed-entity PCI experience; ISO 27001 LA, CRISC, CCAK.

How we work

Full time, Bengaluru, hybrid (full-time is a PCI SSC requirement for QSA)

Global clients – some early/late calls with US and EU time zones

Firm-paid cert maintenance; fully sponsored QSA training, exam and annual requalification

Path to Lead Auditor / Audit Manager and a named QSA on our PCI SSC listing

Apply with your CV and a redacted sample of a report section or working paper you drafted

📌 Senior Audit Associate (Bengaluru)
🏢 Atom Assurances Services
📍 Bengaluru