Senior Information Security Auditor (Technical) – TISAX, NIST & CMMC (GTO, Montreal, Ottawa)
Seratos is seeking an experienced Senior Information Security Auditor to join our growing consulting practice. This client‑facing role is focused on delivering information security auditing, compliance assessments, and certification readiness services across multiple security frameworks, with particular emphasis on ISO/IEC 27001:2022, TISAX® (VDA ISA), NIST Cybersecurity Framework (CSF), NIST SP 800-171, and Cybersecurity Maturity Model Certification (CMMC) .

The successful candidate will lead ISMS audits, conduct technical and governance assessments, perform gap analyses, facilitate readiness activities, and support clients throughout certification and regulatory audit processes. This role requires a strong technical understanding of information security controls, risk management, secure system architectures, and compliance frameworks.

Key Responsibilities
Information Security Audits

Lead and conduct internal audits and independent assessments against information security frameworks including:

TISAX (VDA ISA)

NIST Cybersecurity Framework (CSF)

NIST SP 800-171

CMMC Level 1 and Level 2 requirements

ISO/IEC 27001:2022

SOC 2 Trust Services Criteria

Evaluate the effectiveness of administrative, technical, and physical security controls.

Gap Assessments & Compliance Readiness

Perform detailed gap assessments and maturity evaluations.

Develop practical remediation recommendations and prioritized action plans.

Assess control implementation, evidence quality, and operational effectiveness.

TISAX and CMMC Readiness Programs

Support clients preparing for TISAX assessments and CMMC certification efforts.

Conduct readiness reviews, mock assessments, and evidence validation exercises.

Assist clients in implementing corrective actions and strengthening control environments.

Security Governance & Risk Management

Evaluate information security governance structures, risk management processes, supplier security programs, and incident response capabilities.

Review policies, procedures, standards, and technical documentation for compliance and effectiveness.

Design and facilitate tabletop exercises and cyber incident simulations.

Assess organizational preparedness and provide recommendations for improvement.

Third-Party Audit Support

Support clients during certification audits, customer assessments, regulatory reviews, and external examinations.

Act as a trusted advisor during audit preparation, evidence collection, and auditor interactions.

Prepare comprehensive audit reports, executive summaries, risk assessments,



and remediation roadmaps.

Present findings and recommendations to client leadership, technical teams, and stakeholders.

Stakeholder Engagement

Build strong client relationships and serve as a trusted advisor on information security and compliance matters.

Collaborate with cross‑functional teams including IT, Engineering, Legal, Quality, and Executive Leadership.

Required Qualifications
Experience

Minimum of 5 years of experience in information security auditing, compliance consulting, cybersecurity governance, or risk management.

Demonstrated experience conducting assessments against one or more of the following:

TISAX (VDA ISA)

NIST CSF

NIST SP 800-171

CMMC

ISO/IEC 27001

SOC 2

Experience supporting organizations through external audits, certification assessments, or regulatory reviews.

Technical Knowledge
Strong understanding of:

Information Security Management Systems (ISMS)

Security architecture and technical controls

Identity and Access Management (IAM)

Endpoint and infrastructure security

Cloud security environments (AWS, Azure, Google Cloud)

Incident response and business continuity

Supplier and third‑party risk management

Certifications
Required (one or more):

Certified Information Systems Auditor (CISA)

Strongly Preferred Technical Background

Hands‑on experience in cybersecurity engineering, cloud security, DevOps, infrastructure operations, software development, security operations (SOC), industrial control systems (ICS/SCADA), operational technology (OT), IoT security, or enterprise architecture.

Experience implementing or managing security controls rather than solely auditing them.

Ability to evaluate both the design and operational effectiveness of technical security controls across complex environments.

Experience in regulated industries including automotive, aerospace, defense, manufacturing, critical infrastructure, or technology.

Certifications:

Certified Information Security Manager (CISM)

CISSP

Certified CMMC Professional (CCP)

Certified CMMC Assessor (CCA)

TISAX Assessor qualification or direct TISAX assessment experience

Professional Skills

Excellent written and verbal communication skills.

Robust analytical and investigative capabilities.





Ability to translate complex technical findings into actionable business recommendations.

Experience leading client engagements and managing multiple projects simultaneously.

Strong presentation and stakeholder management skills.

Education

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related technical discipline.

Equivalent combination of education, certifications, and relevant experience will be considered.

Preferred Industry Experience
Experience working with organizations in one or more of the following sectors is highly desirable:

Automotive and Mobility

Defense and Aerospace

Manufacturing

Technology and Software

Critical Infrastructure

Government Contractors

Why Join Seratos?
At Seratos, we believe the best auditors are those who have built, operated, secured, and assessed real‑world systems. We are not looking for professionals whose experience is limited to reviewing documentation and checklists. We are seeking experienced technical practitioners who understand how security controls are implemented in practice and can evaluate their effectiveness in complex environments.

Our clients operate in industries where security is deeply integrated into technology, engineering, and operations. As a result, our auditors regularly assess environments involving:

Cloud and DevOps platforms

Software development and secure SDLC programs

Industrial Control Systems (ICS) and Operational Technology (OT)

IoT and connected‑device ecosystems

Automotive cybersecurity environments

Manufacturing and engineering systems

Critical infrastructure and defense supply chains

Enterprise and hybrid cloud architectures

Unlike large consulting organizations where professionals are often confined to narrow roles, Seratos provides opportunities to work across multiple frameworks, industries, and technical environments. Our consultants and auditors work directly with clients, senior leadership, and subject matter experts to solve complex security and compliance challenges.

We value practical experience and technical credibility. Candidates with hands‑on backgrounds in cybersecurity engineering, DevOps, cloud security, software development, infrastructure engineering, industrial security, IoT security, or security operations are strongly encouraged to apply.

Professionals who thrive at Seratos are those who enjoy bridging the gap between technical implementation and compliance requirements, helping organizations achieve meaningful security outcomes rather than simply passing audits.

#J-18808-Ljbffr

📌 Senior Information Security Auditor (Technical) – TISAX, NIST & CMMC (GTO, Montreal, Ottawa)
🏢 Seratos Consulting
📍 Quebec City