i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor".

My employer told me that my job is described as follow:

  • this job is created because of the need of a technical resource who will take care of technical issues not organisational issues
  • i am attached to the ISO team and not to the IT team
  • i am going to take care of everything related to pentesting, log review, configurtation review, securing electronic threads, backup , ...
  • defining physical and logical security measures that should be taken are not in my scope

i am a little bit confused and can't really understand my responsabilites, moreover i didn't find such job in the ISO norm.

i need to know if there is a such well known job , and what are it's real responabilites


  • This is a conversation to have with your employer. – schroeder Nov 9 '14 at 17:06

I think you're responsibilities is to verify on on-going basis if your company is adhering to the ISO27001. So basically your third point describes what you will be doing: reviews.

Basically you are an auditor, which indeed means you are NOT part of the IT department, but the audit department. This is to ensure independence and objectiveness as no-one of the upper management in the IT department should be able to pressure you based on performance reviews for instance.

Not the answer you're looking for? Browse other questions tagged or ask your own question.