I see CISM as Information Security Manager - aligning the business needs to Info Sy. CISSP is more technical and hands on.
If you're going IT Auditor, are you also looking at ISO27001 LA?
None of the team are ISO27001 LA mainly because we are acting as the internal audit team for the clients and therefore, not independent.