So, for those who want to know how best to get to this position in the IT auditor career path, is it better to focus on a degree or a certification? This article will detail the degree and certification landscapes for the mid-level IT auditor and will offer a solid recommendation for how you should proceed if this question is hanging in your mind.
What is an IT auditor?
IT auditors are cybersecurity professionals tasked with auditing risk and internal controls within an organization’s network and information security environment. The role of IT auditor does not solve security issues within an organization; rather, they focus on finding and documenting these issues. On-the-job work that this role can expect includes identifying security flaws in an organization’s information security, creating action plans to fix said flaws and writing reports to communicate their findings to executives and other decision makers. This role is directly mapped to the National Initiative for Cybersecurity Education’s (NICE) CyberSeek model and is available to entry-level candidates. Without further ado, let’s examine the degree path and certification path to the mid-level IT auditor role.
IT auditor degree requirement
There is one steep requirement for organizations hiring IT auditors — and that is the degree requirement. Nearly 100% of organizations hiring for this role require a degree of some kind. The statistics break down thusly: 76% require a bachelor’s degree, 22% require a graduate degree and 2% require a sub-bachelor’s degree (associate’s). Whether your choice of organization requires one or the other of these degrees comes down to the business need of the organization. While there is no one subject matter of degree that applies to the IT auditor role, there are some common ones that successful candidates have. These include:
Computer science Information technology Information security Accounting Finance Law Administration
The top three degree choices are arguably the most applicable to the IT auditor role, but the others in the list have a place as well. For example, those with accounting degrees can rely on their auditing experience (as much as they have, of course). Please note that you may find that some schools offer graduate degrees with a little more emphasis on applicable IT auditor skills. Those aiming for the mid-level of their IT auditor career may find it smart to pick up one of these more on-point graduate degrees.
IT auditor certification requirements
IT auditors at entry-level career positioning may not need any certifications to gain this role — often, only a degree is required. However, once you get to the mid-level of this career path, organizations are more likely to require at least one certification. Part of this is because certifications can directly certify an IT auditor specific knowledge and skill set. Organizations may also know that being at this level of the career path means that the candidate has likely already earned the requisite experience for these certifications, unlike those at entry-level.
CISA
Hosted by ISACA, the Certified Information Systems Auditor (CISA) certification is the most on-point of all certifications you can earn towards this role. It certifies competency in many of the skills candidates will need to perform this role, including security standards and change controls that are widely used in IT auditing. CISA requires five years of experience to qualify for this certification exam, which should be a walk in the park to prove for those at this career level.
CISSP
According to CyberSeek, (ISC)2’s Certified Information Systems Security Professional certification is the most-requested certification by organizations hiring for this role. CISSP focuses a little bit more on information security skills than IT auditing skills; however, these skills have been found to be useful to IT auditors, as there is a significant overlap of skills in real-world situations. CISSP requires five years of work experience to qualify for this certification exam, which a mid-level IT auditor should have at this point in their career.
CISM
ISACA has earned a spot on the list again with its Certified Information Systems Manager (CISM). This high-powered certification is a favorite among mid-level IT auditors because it covers some on-point knowledge for this role including regulatory issues, information security management, and risk management. There is an experience requirement of three years of information security management experience in at least three of the exam domains of knowledge. Chances are a mid-level IT auditor has already earned this experience and will have no problem with this requirement.
Conclusion
After reading this article, my conclusion should come as no surprise. Those who want to maximize their chances at becoming a mid-level IT auditor should earn a degree and at least one certification. This is a timely recommendation, because the hardest barrier to earning the most relevant certifications for the IT auditor role is the strict experience requirements these certifications feature. Those approaching the mid-level of their career should easily clear this experience hurdle thereby making a number of IT auditor focused certifications within reach. So, for those looking to become a mid-level IT auditor, diversify your education background by earning at least one degree and at least one certification explored above. If you do, you will find yourself in this role without much difficulty.
Sources
So you want to work in information technology audit (IT audit): What about IT audit certifications?, Holowczak Cybersecurity Career Pathway, CyberSeek CISM vs CISSP Certification — What Are the Differences and Which One Is Best For Me?, McAfee
