Director, Cyber Security & IT Audit - Program Office

Overview

The organization is seeking a Director of Cybersecurity & IT Audit to join the Internal Audit team. This role will shape the future of IT risk management and cybersecurity assurance across the enterprise, providing forward-looking insights, challenging current approaches, and helping drive innovation in audit practices and IT governance.

The Director will define, assess, and execute the Cybersecurity & IT Audit plan within Internal Audit, and partner with the Vice President, Internal Audit and senior leadership to support function-wide transformation programs and strategic direction.

Responsibilities

• Develop and execute Cybersecurity and IT audit strategy aligned with business objectives, grounded in a thorough understanding of business operations and risk exposures.
• Lead cybersecurity and IT risk assessments; define risk-based audit programs; and plan, execute, and report on audits and advisory reviews across:
  • cybersecurity, IT, cloud, data protection and privacy
  • identity and access management
  • technology resilience
  • third-party technology risk
  • AI and other emerging technologies
• Lead the IT SOX program, including:
  • ITGC risk assessment and scoping
  • control design
  • oversight of co-sourced testing
  • reliance coordination with external auditors
• Serve as a strategic partner and go-to advisor for Cyber & IT leaders on risk and control matters, aligning on priorities and scoping, planning, and execution.
• Provide independent risk and control perspectives on IT governance, cybersecurity posture, and major technology initiatives, including system implementations and upgrades, cloud migrations, digital transformation, AI, and other emerging technologies.
• Translate complex cybersecurity and technology risks into clear, business-focused insights for senior management and the Audit Committee.
• Manage the Cybersecurity & IT audit budget and resources, including co-source and specialist support as needed.
• Help build and develop audit talent as the team grows.
• Drive innovation and continuous improvement in Internal Audit, including risk-based methodology, data analytics, automation, and AI-enabled audit techniques.

Requirements

• 10–15 years of experience in Cybersecurity and IT Audit, including risk assessment, control evaluation, hands-on audit execution, and strategic advisory across IT environments.
• Strong knowledge of cybersecurity and technology frameworks, including:
  • NIST CSF
  • ISO 27001
  • COBIT
• Demonstrated understanding of EU and UK requirements such as:
  • DORA
  • NIS2
  • GDPR
  • the EU AI Act
• Strong IT SOX experience, including ITGC scoping, oversight of third-party testing, and external auditor reliance.
• Strong understanding of cybersecurity and technology risks across areas such as:
  • ITGCs
  • cloud security
  • identity and access management
  • data protection and privacy
  • encryption
  • vulnerability management
  • network security
  • incident response
  • technology resilience
  • third-party risk
  • AI and emerging technologies

Preferred Qualifications

• CISSP, CISA, CIA, CISM, or CRISC.
• Strong leadership and people skills, including experience developing talent, driving continuous improvement, and building trusted relationships across all levels of the organization.

Compensation & Benefits

• The salary/pay rate listed below is a good faith determination that may be offered to a successful applicant for this position at the time of this job advertisement based on the organization hiring process and budget for this role and may be modified in the future. Actual compensation may vary from posting based on geographic location, work experience, and/or skill level.

Benefits include:

• Remote-first flexibility
• Generous PTO
• 13 paid holidays
• Medical / Dental / Vision insurance
• Life, Disability, and other benefits
• 401k with competitive employer match
• Community Service Days
• Generous parental leave

Work authorization note:

• The organization does not sponsor US work authorizations for this job position including H-1Bs, O-1, and TN. The organization also does not hire F-1s working on EAD for this position.

Location

• Remote-first flexibility.