Lead, Audit and Assurance

Overview

This role is for a Lead, Audit & Assurance professional responsible for developing and executing the audit and assurance strategy within a technology-driven organization. The position involves ownership of external audit success, internal audit program maturity, and overall control effectiveness. The role leads cross-functional initiatives to design and improve scalable, technology-enabled Governance, Risk, and Compliance (GRC) processes, with a focus on audit efficiency, risk visibility, and control performance. It also includes advancing enterprise audit leadership, continuous assurance, and AI-enabled GRC transformation.

Responsibilities

• Manage end-to-end execution of external audit and assessment portfolio, including SOC 2, PCI DSS, ISO 27001, HIPAA regulatory exams, and client audits; act as primary liaison to external auditors ensuring smooth outcomes
• Design, mature, and lead a scalable, risk-based internal technical audit program with methodologies, scoping, testing strategies, and reporting standards that provide independent assurance for leadership
• Maintain and evolve risk and control mappings in the GRC platform to accurately reflect technology footprint, regulatory obligations (FFIEC, PCI DSS, NIST CSF/800-53, ISO 27001), and client contractual commitments
• Implement continuous control monitoring, automated evidence pipelines, and AI-assisted testing to reduce audit cycle time, evidence requests, and control drift, ensuring the organization is always audit-ready
• Identify, evaluate, and adopt AI and automation capabilities across the assurance lifecycle; develop audit approaches for internally deployed AI systems including model risk and data lineage considerations
• Collaborate with technology teams to embed control design into systems and pipelines, enforcing controls through technology where feasible
• Oversee remediation lifecycle for audit findings and control gaps with risk-based prioritization, evidence-backed validation, and executive visibility into trends and residual risk
• Produce executive-level reporting and real-time dashboards on control performance, audit posture, and assurance KPIs/KRIs
• Represent the organization's assurance posture to clients, prospects, and regulators during due diligence, RFPs, and examinations
• Perform other duties as assigned

Requirements

Education

• Bachelor’s degree in Information Assurance, Cybersecurity, Information Systems, Accounting (Audit), or related field, or equivalent combination of education and experience
• Certifications such as CISA, CISM, CRISC, or GSNA strongly preferred; PCI ISA, ISO 27001 Lead Auditor, or AI governance credentials (e.g., AIGP) are a plus

Experience

• Minimum eight (8) years of progressive experience in technical audit, information assurance, or GRC within regulated industries such as financial services, fintech, or healthcare
• At least three (3) years in a lead or senior individual contributor role
• Proven ownership of external audit engagements with consistently clean or low-finding outcomes
• Hands-on experience configuring and operating modern GRC platforms (e.g., Drata, Vanta, AuditBoard, OneTrust, ServiceNow GRC, LogicGate) including multi-framework control mapping, evidence automation, and continuous control monitoring
• Direct experience designing, implementing, or significantly maturing internal technical audit programs in cloud-native SaaS environments
• Preferred experience with AI-enabled or automation-driven assurance capabilities such as automated evidence collection, control testing, or anomaly detection
• Experience influencing cross-functional engineering, security, and product teams and driving enterprise-wide assurance initiatives

Knowledge, Skills & Abilities

• Expert knowledge of security and compliance frameworks relevant to SaaS fintech, including SOC 2, PCI DSS, ISO 27001/27002, NIST CSF, NIST 800-53, CIS Controls, and FFIEC IT Examination Handbook
• Deep technical fluency with cloud-native SaaS environments (AWS/Azure/GCP shared-responsibility models, Infrastructure-as-Code, CI/CD pipelines, identity and access management, encryption, logging)
• Ability to translate manual assurance activities into automated, continuous, system-enforced controls and communicate risk and audit implications to technical and executive audiences
• Working knowledge of AI and machine learning system design, deployment, governance, and associated control considerations (model risk, data lineage, prompt/output handling, third-party AI services, emerging regulations)
• Skilled in setting and defending audit scope, plans, sampling methodology, and evidentiary standards with external auditors and regulators
• Strong analytical judgment to identify systemic risks, control gaps, and improvement opportunities proactively
• Composed and credible in high-stakes discussions with internal stakeholders, external auditors, and clients, maintaining collaborative relationships while holding firm on risk-based positions
• Excellent written and verbal communication skills with experience producing executive-ready audit reports, board-level summaries, and client-facing assurance documentation
• Ability to serve as a senior technical authority on assurance matters and elevate the practice of others without direct reporting authority
• Strong prioritization, judgment, and confidentiality skills
• Ability to work remotely with high productivity and limited supervision
• Must pass background checks to access sensitive information

Travel

• Minimal travel, generally 12 days or less per year, including two team gatherings annually

Compensation & Benefits

Details on compensation and benefits are not provided in the job description.

Location

Remote work is supported; no specific geographic restrictions mentioned.