About this role
We are looking for an experienced and detail-oriented Senior IT Auditor / IT Risk Professional to join our Internal Audit / Risk Advisory team. The role will be responsible for independently leading and executing IT audits with a strong focus on IT General Controls (ITGCs), SOX compliance, application controls, information security, third-party risk, and SAP Security.
The successful candidate will be expected to manage audit engagements from risk assessment and scoping through testing, issue identification, stakeholder discussions, reporting, and remediation follow-up, while providing guidance and review support to junior team members.
- Lead and execute ITGC and SOX audits across access management, change management, IT operations, backup/recovery, and privileged access.
- Perform risk assessments, control walkthroughs, Design Effectiveness (DE), and Operating Effectiveness (OE) testing.
- Evaluate application, automated, and configurable controls.
- Review SOC 1/SOC 2 reports and assess relevant complementary controls.
- Lead SAP Security and SoD reviews, including roles, authorizations, and privileged access.
- Identify control deficiencies, assess risk impact, and develop clear audit findings.
- Manage audit evidence, workpapers, issue validation, and remediation tracking.
- Partner with IT, cybersecurity, finance, and business stakeholders to resolve audit issues.
- Review junior auditor work and provide coaching and guidance.
- Support continuous improvement of audit methodologies, testing approaches, and reporting.
- 8+ years of experience in IT Audit, IT Risk, SOX, Internal Audit, or Risk Advisory.
- Strong knowledge of ITGC, SOX 404, application controls, and information security.
- Experience with SAP Security, SAP GRC, and Segregation of Duties (SoD) preferred.
- Strong understanding of SOC 1/SOC 2, IT risk assessment, control testing, and audit methodologies.
- Working knowledge of SQL, databases, Windows/Unix, cloud technologies, and Excel.
- Experience with audit/data analytics tools such as ACL, Alteryx, or Power BI is an advantage.
- CISA, CIA, CRISC, CISSP, or ISO 27001 certification preferred.
- Excellent analytical, communication, stakeholder-management, and leadership skills.