The auditor needs enough technical understanding to judge the evidence. They should be able to tell whether an access review checked permissions or only listed users, and whether a restore test proves the backup works. They also need to ask a follow-up question when an answer sounds too smooth.
Audit method and knowledge of the standard matter more. An auditor has to sample sensibly, interview without leading, trace a control from the policy through the procedure to the record, and grade what they find. A senior engineer without that training tends to audit how they would have built the system, which answers a different question from the one the standard asks.
For areas that need deep technical knowledge, such as cloud configuration, network segmentation or secure development, the audit guidance in ISO 19011 allows a technical expert to support the auditor. In practice this might be a cloud security specialist joining for half a day to review the AWS setup together with the auditor. The auditor stays responsible for the findings.
For a typical SaaS company a mix works well: an auditor who understands cloud environments and identity management, with a specialist on call for the few areas that go deeper.