Who We Are

Join a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people-first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For® list for eleven consecutive years. We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit www.careers.firstam.com.

What We Do

Executes assigned testing for Corporate technology and cybersecurity operational audits. Evaluates controls and supporting evidence, documents clear and supportable results, and raises exceptions and emerging risks to the Senior IT Auditor or Manager.

Essential functions

• Perform assigned audit procedures, including walkthroughs, control assessments, population validation, sample selection, evidence inspection, reperformance, and follow-up testing.
• Test controls in operational cybersecurity and data-risk areas, including IAM/PAM and Active Directory; network security and firewalls; cloud security architecture and WAF; Security Operations, incident response, and SIEM/XDR/SOAR; vulnerability management and CTI; data protection and privacy, including DLP, encryption, and key management; and application security and Secure SDLC.
• Inspect and test technical and architecture evidence, including configurations, access records, scan results, change records, logs, encryption, certificates, and documented exceptions in the assigned specialty, such as IAM/PAM, Active Directory, firewalls and network security, cloud/WAF, SIEM/XDR/SOAR, DLP, key management, or vulnerability controls.
• For audits involving cloud environments, consult relevant cloud-provider security guidance to inform walkthroughs and testing. Consider recommendations for areas such as network security, access, segmentation, logging, and secure connectivity, alongside company policies, standards, and audit criteria.
• Evaluate whether evidence is complete, reliable, relevant to the control, and consistent with the control objective. Identify gaps or contradictions and raise them promptly.
• Document procedures, evidence reviewed, sample details, results, exceptions, and conclusions in organized, traceable workpapers.
• Participate in walkthroughs and client discussions; explain evidence requests and testing questions clearly and follow up on outstanding items.
• Analyze exceptions and support the assessment of their cause, impact, extent, and potential compensating controls.
• Support issue development, report preparation, issue validation, and examination support materials.
• Use audit tools and data analysis techniques where appropriate to validate populations, identify anomalies, or improve testing coverage.
• Incorporate review comments and maintain audit files in line with Internal Audit quality standards.

Required qualifications

• At least 3 years of relevant experience in IT audit, cybersecurity audit, technology risk, or related control testing, including at least 2 years directly performing IT or cybersecurity operational audits.
• Hands-on operational audit testing in at least one target profile: (1) IAM/PAM, including CyberArk, Active Directory, or firewall/network controls; or (2) cloud security/WAF, SIEM/XDR/SOAR, DLP, encryption/key management, or vulnerability evidence. Experience limited to general ITGC testing is insufficient. Comparable tools are acceptable.
• Working knowledge of risk-based audit testing, evidence evaluation, sampling, workpaper documentation, and communicating exceptions.
• Familiarity with official security guidance for Microsoft Azure, AWS, and Google Cloud, including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance; able to apply relevant guidance during audit testing.
• Ability to manage assigned testing, meet deadlines, and raise questions or concerns promptly.
• Strong analytical, written, and verbal communication skills, including the ability to explain evidence needs to technical and nontechnical stakeholders.

Preferred experience

• Experience testing controls in multiple technology or cybersecurity audit areas, especially Vulnerability Management, Network Security, Security Operations, Data Protection, Offensive Security, Application Security, Cloud Service Management, or Secure SDLC.
• Banking or financial-services experience; exposure to GLBA, Interagency Guidelines, SWIFT CSP, PCI DSS, OWASP, CIS Benchmarks, NIST CSF, or NIST SP 800-series guidance.
• Hands-on exposure to cloud environments or cloud security controls.
• CISA or another relevant certification, or active progress toward one.
• Relevant IT or cybersecurity coursework, professional training, or hands-on experience.
• Familiarity with AuditBoard, Power BI, ServiceNow, Jira, or SailPoint.

Pay Range: $73,900.00 - $98,500.00 Annually

This hiring range is a reasonable estimate of the base pay range for this position at the time of posting. Pay is based on a number of factors which may include job-related knowledge, skills, experience, business requirements and geographic location.

First American will consider for employment all qualified applicants, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws (e.g., the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act).

First American intends to conduct a review of an applicant’s criminal history in connection with a conditional offer. First American reasonably believes that a criminal history may have a direct, adverse and negative relationship with the following material job duties for this position potentially resulting in the withdrawal of the conditional offer of employment: handling of confidential, proprietary or trade secret information belonging to First American or its customers, administrating or facilitating financial transactions, and the ability to meet customer-imposed criminal history requirements.

What We Offer

By choice, we don’t simply accept individuality – we embrace it, we support it, and we thrive on it! Our People First culture is inclusive for all employees - not just because it's the right thing to do, but because it's the key to our success. We are proud to foster an authentic and inclusive workplace For All. You are free and encouraged to bring your entire, unique self to work. First American is an equal opportunity employer in every sense of the term.

Based on eligibility, First American offers a comprehensive benefits package including medical, dental, vision, 401k, PTO/paid sick leave and other great benefits like an employee stock purchase plan.