Virtual Pay represents a new breed of payment companies, built from the ground up with a laser-focus of innovating and seamlessly integrating tomorrow's payment solutions.

Job Summary

The Internal IT Auditor is a hands-on technical role focused on evaluating, monitoring, and auditing the organization's technical systems, infrastructure, and core operating applications. This position ensures that engineering configurations and technical architecture satisfy the requirements of our Information Security Management System (ISMS), ISO/IEC 27001/2022, and PCI DSS v4.0. Operating as an Internal Security Assessor (ISA), this individual bridges the gap between pure policy and technical implementation, verifying system controls at the root level before formal external validation.

Key Responsibilities

Technical ISMS & System Auditing: Audit system configurations, cloud architectures (OCI/AWS/Azure), operating systems, and network parameters to ensure continuous alignment with ISO 27001/2022 and internal security manuals (ISMs).

PCI DSS Internal Assessment (ISA Role): Perform routine internal audits of the Cardholder Data Environment (CDE). Maintain data flow and network segmentation diagrams, review daily security logs, and validate network boundaries as a certified or equivalent Internal Security Assessor (ISA).

Control Testing & Technical Validation: Go beyond paperwork to verify active technical controls: audit Multi-Factor Authentication (MFA) enforcement, Role Based Access Control (RBAC) consistency, vulnerability patch cycles, and endpoint protection rules.

Biometric & Identity Access Audit: Evaluate specialized identity verification controls—including biometric hardware and enrollment software workflows (leveraging ISO/IEC 20027 guidelines where applicable —to confirm highly secure physical and logical entry points.

Cross-Framework Mapping: Maintain a unified technical control crosswalk to eliminate duplicate audit tasks by mapping system security configurations simultaneously to PCI DSS controls and ISO 27002 clauses.

Evidence Gathering & Log Inspection: Extract and interpret evidence straight from technical systems (e.g., SIEM logs, firewall rulesets, encryption keys, and pipeline vulnerability scans).

Key qualifications:

Bachelor’s degree in IT, Computer Science, Cybersecurity, or an equivalent technical field.

4+ years of demonstrable experience auditing IT systems, verifying infrastructure security, or supporting an active corporate ISMS.

Information Security Certifications are highly valued:

• Active or prior PCI ISA or QSA designation.
• ISO 27001 Internal Auditor / Lead Auditor.
• CompTIA Security+, CISA or CEH.

• Audit system configurations, cloud architectures (OCI/AWS/Azure), operating systems, and network parameters to ensure continuous alignment with ISO 27001/2022 and internal security manuals (ISMs).
• Perform routine internal audits of the Cardholder Data Environment (CDE). Maintain data flow and network segmentation diagrams, review daily security logs, and validate network boundaries as a certified or equivalent Internal Security Assessor (ISA).
• Go beyond paperwork to verify active technical controls: audit Multi-Factor Authentication (MFA) enforcement, Role Based Access Control (RBAC) consistency, vulnerability patch cycles, and endpoint protection rules.
• Evaluate specialized identity verification controls—including biometric hardware and enrollment software workflows (leveraging ISO/IEC 20027 guidelines where applicable —to confirm highly secure physical and logical entry points.
• Maintain a unified technical control crosswalk to eliminate duplicate audit tasks by mapping system security configurations simultaneously to PCI DSS controls and ISO 27002 clauses.
• Extract and interpret evidence straight from technical systems (e.g., SIEM logs, firewall rulesets, encryption keys, and pipeline vulnerability scans).

• ISO 27001/2022
• PCI DSS v4.0
• Information Security Management System (ISMS)
• Internal Security Assessor (ISA)
• cloud architectures (OCI/AWS/Azure)
• Multi-Factor Authentication (MFA)
• Role Based Access Control (RBAC)
• vulnerability patch cycles
• endpoint protection rules
• biometric hardware
• enrollment software workflows
• ISO/IEC 20027
• SIEM logs
• firewall rulesets
• encryption keys
• pipeline vulnerability scans

• BA/BSc/HND
• Professional Certificate
• Bachelor’s degree in IT, Computer Science, Cybersecurity, or an equivalent technical field.
• Active or prior PCI ISA or QSA designation.
• ISO 27001 Internal Auditor / Lead Auditor.
• CompTIA Security+, CISA or CEH.