Cybersecurity Auditor: Role, Skills, Career Path
A cybersecurity auditor independently checks whether an organisation's security controls are designed well and working as claimed, against a standard, law, contract or its own policy, and reports the gaps. The work is planning, evidence collection, control testing and report writing. Many auditors hold ISACA's CISA certification.
BLS has no separate category for auditors of security, so pay and growth below use the nearest occupation, information security analysts: a median of $129,180 in May 2025 and projected growth of 21 percent from 2025 to 2035. This page covers the role, a day in the job, skills, certifications and a first-job plan. Last reviewed 3 November 2026.
Updated 3 November 2026
What the job involves
- Scope and plan. Agree which systems, processes and period are in scope and which criteria apply (for example ISO/IEC 27001 or the SOC 2 criteria).
- Understand the control. Interview owners and read policies: what is supposed to happen, who does it, how often.
- Test. Sample evidence to see whether it happened: access reviews signed, changes approved, backups restored, logs retained.
- Evaluate. Decide whether a gap is a finding, how severe it is and what caused it.
- Report. Write findings in plain language with the evidence, the criterion, the risk and a recommendation. Management responds with owners and dates.
- Follow up. Check that agreed actions were closed.
ISO 19011 gives guidance on auditing management systems and is widely used as the vocabulary for planning and conducting audits.
Internal, external and IT audit
| Path | Who they work for | Typical work |
|---|---|---|
| Internal audit / IT audit | The organisation | Tests controls through the year; reports to management and the audit committee. Often includes SOX IT general controls. |
| External or third-party audit | A firm or certification body | Examines a client against a standard, such as SOC 2 or ISO/IEC 27001. |
| GRC / compliance analyst | The organisation | Prepares evidence and maps controls so audits go smoothly. See what is GRC. |
| Technology risk (audit firm) | An assurance firm | Reviews client IT controls as part of financial or risk engagements. |
Skills that matter
- Control thinking: reading a control objective and working out what evidence would prove it. Practise with the control library and the ISMS Builder.
- Framework literacy: NIST CSF 2.0, ISO/IEC 27001, SOC 2 criteria.
- Sampling and evidence: choosing a sample, recording what you saw, keeping a defensible trail. The audit log integrity checker shows what trustworthy logs look like.
- Technical basics: identity and access management, logging, change and vulnerability management, cloud shared responsibility.
- Writing and interviewing: short findings an executive can act on, and questions that do not put owners on the defensive.
For planning practice, the internal audit planner walks through scope, criteria and schedule.
Certification, pay and outlook
CISA is ISACA's certification for auditing, monitoring and assessing IT and business systems. ISACA lists five domains: Information Systems Auditing Process; Governance and Management of IT; Information Systems Acquisition, Development and Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets. Listed exam fees are US$575 for members and US$760 for non-members. Check ISACA for the experience rule and current fees. For all certification options, see the certifications guide; the management track is covered in the CISM guide.
Pay and growth. BLS publishes no figure for security auditors. The nearest occupation, information security analysts, had a median annual pay of $129,180 in May 2025, and BLS projects 21 percent employment growth from 2025 to 2035, much faster than the average for all occupations. BLS also notes that specialised certifications, such as in systems auditing, are available. Use the salary explorer to compare occupations.
How to get your first audit role
- Pick one framework and learn its structure, then score a fictional company with the ISO 27001 or SOC 2 readiness checklists.
- Write a one-page audit plan and a three-finding report from that assessment. Keep it as a work sample.
- Apply to GRC analyst, compliance and internal audit roles; they are the usual entry points. See the career path guide.
- Add CISA once you meet ISACA's experience requirement.
Frequently asked questions
What does a cybersecurity auditor do?
A cybersecurity auditor independently checks whether an organisation’s security controls are designed well and operating as stated, against a standard, a law, a contract or the organisation’s own policy. They plan the audit, collect evidence, test controls, record findings and report them to management. Internal auditors work for the organisation; external auditors are engaged from outside, for example for a SOC 2 report or an ISO/IEC 27001 certification audit.
What is the difference between an auditor and a penetration tester?
A penetration tester attacks systems to show what an attacker could do. An auditor checks controls against criteria and evidence, such as whether access reviews happened, logs are kept and changes are approved. Both report findings, but the auditor’s question is "does the control exist and work as claimed?" and the tester’s is "can it be broken?".
What certification do cybersecurity auditors need?
None is legally required in general, but many employers look for the Certified Information Systems Auditor (CISA) from ISACA. ISACA lists five domains: Information Systems Auditing Process; Governance and Management of IT; Information Systems Acquisition, Development and Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets. Fees listed on ISACA’s site were US$575 for members and US$760 for non-members (checked 3 November 2026).
How much do cybersecurity auditors earn?
The US Bureau of Labor Statistics has no occupation called cybersecurity auditor, so we quote the nearest one. For information security analysts, BLS reports a median annual pay of $129,180 in May 2025 and projects employment to grow 21 percent from 2025 to 2035. Auditor pay varies by employer, location and seniority, and an audit-focused role may sit above or below that figure.
Do I need a technical background to become a security auditor?
It helps to understand how systems, networks and access control work, but audit is mostly about evidence, risk and clear writing. Auditors come from IT operations, accounting, risk, compliance and security teams. BLS notes that many information security analysts first work in IT roles such as network and systems administration.
What standards do security auditors audit against?
Common ones are ISO/IEC 27001, the AICPA Trust Services Criteria used in SOC 2 reports, NIST CSF 2.0, PCI DSS and, for listed US companies, the IT general controls behind Sarbanes-Oxley. Which applies depends on the customer, regulator or contract. Our guide to GRC explains how they fit together.
How do I get my first audit job?
Build evidence of the work: run a mock readiness assessment for a standard, write a short audit plan and report, learn to test a control and document it. Apply to internal audit, GRC analyst and compliance roles, or to audit firms’ technology risk teams. A certification such as CISA can follow once you have the experience ISACA requires.
Is cybersecurity auditing a good career?
It suits people who like structure, evidence and communication. It involves less hands-on technical work than engineering or incident response, and more interviews, sampling and report writing. It also leads into GRC management, risk and the CISO path. Whether it is good for you depends on what work you enjoy.