Internal Audit - Manager (Remote)

Overview

This role is a hands-on IT audit lead position within Risk & Assurance. You will own IT audit coverage for a defined portfolio of financial applications, cloud platforms, and security tooling—running engagements end to end, setting the testing approach, and improving how data, automation, and AI are used to deliver assurance.

Responsibilities

• Lead IT audit engagements end to end with limited supervision, including:
  • Scoping and risk assessment
  • Walkthroughs
  • Design and operating effectiveness testing
  • Issue development
  • Remediation validation
• Own the Sarbanes-Oxley Section 404 (SOX 404) IT general controls program for an assigned portfolio, including:
  • Access to programs and data
  • Change management
  • Program development
  • IT operations
• Test IT application controls, key reports, interfaces, and system-generated data supporting financial reporting across ERP and other in-scope financial applications.
• Perform annual and ad-hoc segregation of duties (SoD) analysis, including data-driven extraction, normalization, deduplication, conflict ruleset maintenance, identification of conflicting access combinations and privileged access exceptions, and collaboration with process owners to validate, justify, or remediate results.
  • Drive automation of extraction, normalization, and comparison steps to create a repeatable and monitorable process.
• Audit identity and access management across the enterprise, including:
  • Directory services
  • Enterprise single sign-on
  • Identity governance and access certification platforms
  • Privileged access and secrets management tooling (password vaults and safes)
  • Joiner/mover/leaver provisioning, privileged access, and periodic user access reviews
• Evaluate change and release management controls across modern DevOps toolchains, including:
  • Git-based source control
  • CI/CD pipelines
  • IT service management platforms such as Jira and ServiceNow
  • Automated approvals and separation of duties between development and production
• Assess controls over cloud infrastructure and enterprise data platforms, including:
  • Configuration
  • Encryption
  • Logging and monitoring
  • Data pipeline integrity
• Perform cybersecurity and cloud security assessments for SaaS product environments handling sensitive client data.
• Support third-party risk and service organization report reviews, including:
  • Reviewing SOC 1 and SOC 2 reports
  • Transcribing and mapping complementary user entity controls (CUECs) to internal controls
  • Assessing subservice organization coverage and bridge letters
• Contribute to emerging-risk coverage as AI use expands, including AI and model governance controls evaluated against frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001.
• Use data analytics and AI-assisted tooling to enhance audit effectiveness, including:
  • Scripted population extraction
  • Full-population testing where practical
  • Automated continuous monitoring
• Prepare clear, well-supported work papers and summarize findings for review with the Chief Audit Executive and/or the Senior Manager, IT Risk & Assurance.
• Serve as the liaison between external auditors and internal stakeholders, including:
  • Coordinating IT scoping and walkthroughs
  • Owning evidence and PBC requests end to end
  • Supporting reliance discussions on internal audit work
  • Translating external auditor expectations into practical asks for system and process owners
  • Tracking open items through closure
• Partner with IT, Engineering, Security, Finance, and business process owners to efficiently identify, communicate, and retrieve population and sample requests.
• Drive improvement of internal control structures through practical control design and process enhancement recommendations.
• Coach and review junior auditors and co-sourced resources; help maintain testing standards, templates, and documentation quality.
• Keep leadership informed of progress, control weaknesses, and audit findings; meet established deadlines while maintaining confidentiality.

Requirements

• Bachelor’s degree in information technology, information systems, computer science, accounting or a related field; equivalent practical experience will be considered.
• Approximately 3–5 years of progressive IT audit experience, such as:
  • Public accounting
  • A national firm
  • Corporate internal audit at a technology, SaaS or financial services company
  • At least 3 years is recommended, including meaningful exposure to owning or leading ITGC and SOX 404 testing (not just executing test steps).
• Hands-on experience testing IT general and application controls over a major ERP—Oracle strongly preferred (SAP, NetSuite, or comparable also valued)—and over cloud-hosted business applications such as HCM, CRM, revenue, and data warehouse platforms.
• Enthusiasm for using AI and automation to change how audit work gets done, including building AI-assisted workflows for audit testing and replacing recurring manual procedures with scripts and continuous monitoring.
• Working knowledge of identity governance and privileged access concepts, including directory services, single sign-on, access certification, and privileged credential management; ability to evaluate access evidence critically.
• Cloud audit experience in AWS (Azure or GCP also relevant), including:
  • IAM
  • Logging
  • Network segmentation
  • Key management
  • Configuration baselines
• Familiarity with control frameworks and regulatory standards, including:
  • COSO 2013, COBIT, NIST CSF and SP 800-53
  • ISO/IEC 27001
  • SOC 1 and SOC 2
  • PCI DSS
  • GDPR, HIPAA
  • US state privacy law including the CCPA/CPRA
• Data and scripting ability, including:
  • Advanced Excel, including Power Query
  • SQL and Python are immediately useful
  • PowerShell, VBA, Power BI or Tableau, shell scripting, regular expressions, and working with REST APIs are valuable
  • Demonstrated depth in two or three of these areas is expected.
• CISA achieved or actively being pursued.
  • CISSP, CIA, CRISC, CPA, ISO/IEC 27001 Lead Auditor, or an AWS certification are a plus.
• Experience with GRC and audit management platforms (AuditBoard, ServiceNow IRM, Workiva or similar) preferred.
• Pro-active and independent thinking in analyzing and developing solutions to complex problems.
• Strong written and verbal communication, including explaining technical control failures to non-technical finance or business audiences.
• Comfortable working across global teams and time zones in a fast-moving public company environment.

Preferred Qualifications

• Experience mapping complementary user entity controls (CUECs) to internal control sets.
• Experience supporting third-party risk activities involving SOC 1 and SOC 2 report reviews and bridge letters.
• Prior use of audit management platforms such as AuditBoard, ServiceNow IRM, or Workiva.

Compensation & Benefits

• Targeted base pay range: $80,500 to $126,500 (range reflects differences in candidate knowledge, skills, and experience).
• Highly competitive compensation, benefits, and rewards programs.

Location

Global, with comfort working across global teams and time zones.