Senior IT Auditor

Role and required experience

5+ years of progressive, hands-on IT audit beyond routine SOX testing. Independently own risk-based or operational audits from scope and risk assessment through testing, documentation, and reporting with limited guidance.

• Learn unfamiliar systems, processes, data flows, and connections; design procedures when existing programs are absent or insufficient. Initial work is expected to include a financial reconciliation application post-implementation review; build on existing planning through completion. Prior application experience is not required.

• Assess IT risks, internal controls, ITGCs, logical/privileged access, and change management. Interview auditees, investigate gaps, and exercise independent judgment.
• Produce risk/control matrices, audit programs, test documentation, and defensible workpapers. Use Excel and audit analytics; communicate evidence, findings, business risk, and practical recommendations clearly. Work remotely with regular checkpoints.

A SOX-heavy background can qualify through independent operational audit ownership; information-security experience alone is insufficient. Discuss specific nonconfidential audit examples; written answers and work samples are not mandatory.

Preferred qualifications and framework guidance

CISA; CISSP/CIA/CPA or comparable certifications; Power Query/Optro; Big Four or similar firms; cybersecurity, operations, infrastructure, applications, emerging-technology, advisory, or other non-SOX audits.

Frameworks may include COBIT, COSO, NIST CSF, or applicable ISO standards; experience with every framework is not required.

PCI audits are external under Information Security; Internal Audit monitors them, so direct PCI delivery is not required.