IT Audit Manager

About the position

Performs data-driven, risk-based IT audit assessments of key software systems and applications using Identity and Access Management, Authentication Services, DevSecOps, and Encryption. Reports on technical issues and software solutions to improve the control environment within operating systems -- UNIX/Linux, Windows, and Mainframe, Amazon Web Services (AWS), Azure, Openstack, and Google. Identifies and assesses technological risks and provides advice to management regarding mitigation of these risks using Datadog, CloudAware, Divvy Cloud, and Cloudability. Enhances existing IT controls and enterprise cybersecurity frameworks within database systems -- Oracle, DB2, and SQL Server. Develops automation for assessing controls related to software applications, systems, networks, computer operations, databases, and production support processes using Python, PowerShell, and Java.

Responsibilities

• Evaluates the design and effectiveness of applications, infrastructure, and cybersecurity controls and processes.
• Identifies and addresses systemic gaps in control environment technology risk management.
• Develops data analytics, and applies leading edge technologies and automated tools to provide management with proper context of potential exposures (to control weaknesses).
• Develops an ongoing trusted advisor relationship with internal clients and Audit business unit colleagues to ensure timely and consistent controls advice.
• Collaborates with business, technology, security, legal, and privacy practitioners to evaluate initiatives that protect employee and customer privacy.
• Collaborates with application developers, system architects, engineers, and security practitioners to perform readiness assessments of pre-production applications and systems.
• Develops and implements strategies to mitigate risks and enhance the overall security posture.
• Communicates emerging issues across technologies and business processes to management and stakeholders.
• Leverages audit automation tools in the evaluation of business operations and systems.
• Performs and reviews audit test work by organizing and analyzing data, testing controls and documenting results.
• Applies strategic and data analytics concepts, principles, and techniques to more efficiently and effectively identify control deficiencies.
• Drafts audit reports to provide a clear description of issues identified, related implications to the business or enterprise as a whole and management action plans to resolve the issues.
• Plans and executes concurrent IT audits -- including reviews of cybersecurity, existing production applications, systems currently being developed, technology infrastructure, and specialized/emerging technologies.
• Works with management to build an understanding of complex functions in order to assess the design and operating effectiveness of controls.
• Participates in professional teams to execute technical audit projects.

Requirements

• Bachelor's degree (or foreign education equivalent) in Computer Science, Engineering, Information Technology, Information Assurance, Mathematics, Physics or a closely related field and three (3) years of experience as an IT Audit Manager (or closely related occupation) performing IT audit, information security, and risk management of enterprise or financial services applications and IT infrastructure (on premises or in the Cloud).
• Or, alternatively, Master's degree (or foreign education equivalent) in Computer Science, Engineering, Information Technology, Information Assurance, Mathematics, Physics or a closely related field and one (1) year of experience as an IT Audit Manager (or closely related occupation) performing IT audit, information security, and risk management of enterprise or financial services applications and IT infrastructure (on premises or in the Cloud).

Nice-to-haves

• Demonstrated Expertise ('DE') coordinating operational and technology risk analysis and assessments of financial applications and processes using data visualization and reporting on Power BI.
• DE coordinating and executing risk-based and data-driven audit engagements for large-scale financial service technology platforms on Amazon Web Services (AWS) - including containers (ECS or EKS) and database environments (RDS, Dynamo Db, Oracle on EC2, S3, or Snowflake).
• DE evaluating the security and quality control design and effectiveness for Continuous Integration/Continuous Deployment (CI/CD) pipelines and tooling using DevOps and vulnerability scanning platforms -- Bitbucket, Github, Jenkins, Artifactory, or Mend.
• DE evaluating IT General controls by performing control evaluation in adherence to cybersecurity principles and information security standards -- NIST CSF, ISO 27001.

Benefits

• Flexible benefits that support you through every stage of your career.
• Opportunities for learning to build your career.
• Recognition as a top 10 Best Place to Work in 2024.