Cybersecurity Audit Associate II

Sempra: Where opportunity powers impact

At Sempra, a better world begins with better energy-and with people who want to make a difference. That's why we're tackling the biggest challenges facing our industry while building ahighperformance culture where you can do your best work. Together, our teams support nearly 40 million consumers across the U.S., strengthening the communities we serve and creating impact that extends far beyond the workplace. Here, collaboration, inclusivity and shared purpose empowers you to grow your passion, build a rewarding career and contribute to something bigger-helping shape a better energy future for all.

Primary Purpose

The role conducts internal audits of IT systems with an emphasis on cybersecurity. The position executes testing primarily of cybersecurity controls in IT and operational technology audits, strengthening critical infrastructure cybersecurity. It applies experience in audit documentation and techniques and a passion for cybersecurity excellence to effectively obtain relevant evidence, perform testing, and communicate issues and improvement recommendations in reports. It recommends practical adjustments to test steps, communicate routine issues to stakeholders, and contribute to reporting, as well as executes a broad range of testing and analysis for information systems audits.

Duties and Responsibilities

• Performs control testing for application, technology, and operations processes and evaluates whether evidence meets defined criteria.
• Analyzes privileged access, security configuration hardening, logging and other cybersecurity control artifacts to identify exceptions and potential impact.
• Summarizes testing results and drafts preliminary observations that link criteria, condition, cause, and effect.
• Coordinates with technology teams to obtain extracts or configuration exports required for sampling and analysis.
• Participates in entrance and exit meetings, explaining straightforward procedures and conclusions.
• Contributes to followup reviews by confirming remediation activities and gathering validation evidence.
• Performs other duties as assigned.