IT Audit Manager

Team Introduction

Internal Audit plans and executes audit projects according to our risk-based audit plan, and evaluates the efficiency and effectiveness of financial, compliance, operational, and IT processes and controls. We collaborate with business functions in addressing risks and improving the control environment through timely and comprehensive audit work and remediation action tracking.

We are seeking a hands-on Technology Audit Leader to lead and execute complex technology and cybersecurity audits across the USDS Joint Venture. This role requires strong technical audit expertise, the ability to independently perform end-to-end audit work, and the judgment to translate complex technology risks into clear business impacts for senior leadership.

Responsibilities

• Lead and independently execute end-to-end technology and IT audit engagements, including risk assessment, scoping, planning, walkthroughs, fieldwork, control testing, issue development, reporting, and remediation validation.
• Develop risk-based audit programs and perform hands-on testing across IT general controls, application controls, automated controls, technology-dependent business processes, and cybersecurity controls.
• Assess technology risks across cloud infrastructure, cybersecurity, identity and access management, software development lifecycle, DevOps, CI/CD, vulnerability management, data security, privacy, infrastructure, applications, and third-party technology services.
• Evaluate cloud and infrastructure security controls, including privileged access, configuration management, network security, logging and monitoring, vulnerability management, and data protection.
• Assess SDLC and engineering controls, including source code management, change management, CI/CD pipelines, release management, production access, and automated deployment processes.
• Conduct technology risk assessments and identify emerging risks and control gaps across a complex and rapidly evolving technology environment.
• Apply relevant technology and security frameworks and standards, including CISA, NIST, ISO 27001, COBIT, SOC 2, and COSO.
• Use data analytics, automation, and technology-enabled audit techniques to improve audit coverage, testing efficiency, and risk identification.
• Quantify technology risk exposure and clearly articulate the operational, regulatory, security, financial, and business impacts of audit findings to senior leadership.
• Develop practical, value-added recommendations and partner with Engineering, Security, Infrastructure, Privacy, Compliance, Product, and other technology teams to strengthen the control environment.
• Participate in the annual USDS IT risk assessment and develop the risk-based technology audit plan in partnership with the Head of USDS Internal Audit.
• Review audit workpapers and deliverables for technical accuracy, completeness, and compliance with Internal Audit methodology while providing hands-on coaching and technical guidance to auditors and co-source resources.
• Manage technology audit co-source partners while maintaining direct ownership of audit scope, execution, conclusions, quality, and deliverables.
• Support the development and growth of the in-house technology audit team, including future IT audit hires, technical training, audit methodology, and best practices.
• Collaborate with Global Internal Audit on joint technology audit initiatives, risk assessments, methodology, and cross-functional projects.
• Monitor emerging technology, cybersecurity, regulatory, and industry developments and incorporate relevant risks into the audit plan.
• Present audit results, significant technology risks, and remediation progress to senior leadership and relevant governance forums.
• Adapt to the evolving needs of the USDS Internal Audit function and take on additional responsibilities as the technology risk landscape and organization develop.

Minimum Qualifications

• 10+ years of IT audit experience, ideally in a technology company, consulting firm, or highly regulated industry.
• Bachelor’s degree or higher in Information Systems, Computer Science, Accounting, Finance, or a related field.
• Strong understanding of technology risk frameworks and industry standards, including CISA, NIST, ISO 27001, COBIT, SOC 2, and relevant regulatory requirements.
• Experience managing in-house teams and co-source/third-party audit partners and leading complex audit engagements.
• Experience engaging with IT, security, compliance, and engineering teams to assess risks and controls. Ability to work in a fast-paced, evolving environment with shifting priorities.
• Strong interpersonal skills with a collaborative, relationship-driven approach. Willingness to travel domestically and internationally, depending on the audit area.

Preferred Qualifications

• Professional certifications preferred: CPA, CIA, CISA, CISSP, CRISC, or equivalent.
• Experience auditing large-scale cloud environments such as AWS, Azure, or GCP.
• Experience auditing cybersecurity, privacy, data governance, AI/ML, platform security, or highly regulated technology environments.
• Experience using data analytics, scripting, automation, or AI-enabled tools to enhance audit testing and risk assessment.
• Excellent communication, interpersonal, and written skills.