Summary
What you’ll impact
The Senior ITGC Auditor designs and operates an end‑to‑end IT General Controls program to assess technology risk. The role employs Auditboard, Vanta, NetSuite, Salesforce, Workday and LLM tools such as ChatGPT to automate testing and documentation. Key duties include building testing plans for access, change, and operations controls, reviewing SOC 1/2 reports, and driving remediation. Collaboration spans the CIO office, engineering, security, finance, and external audit partners, ensuring clear communication of control findings.
Responsibilities
What you'll do
- You'll work closely with the CIO organization, Engineering, Security, Finance, external audit, and a co-source partner to build a rigorous, efficient ITGC program from the ground up.
- Contribute to the IT risk assessment and translate it into a prioritized testing plan across access, change management, and operations.
- Design new ITGC testing processes, workpaper templates, and documentation frameworks from scratch.
- Coordinate with external audit and the co-source partner on timelines, deliverables, and open items for IT controls.
- Lead walkthroughs with system owners and IT stakeholders across key applications and infrastructure.
- Test access provisioning/deprovisioning, change management, and system operations controls across in-scope systems.
- Assess SOC 1/SOC 2 reports for key vendors and subservice organizations, and evaluate complementary user entity controls (CUECs).
- Assess control deficiencies for severity and root cause, and drive remediation plans to completion with system and process owners.
- Implement AI-driven and automated solutions to reduce manual testing effort and improve testing coverage.
Requirements
What you’ll bring
- 3+ years of experience in IT audit, ITGC testing, or a related IT risk/compliance function
- Experience at a large professional services firm or co-sourcing environment in IT audit
- Demonstrated experience building or significantly enhancing an ITGC testing program or methodology from scratch
- Strong understanding of access management, change management, and system operations control concepts
- Experience reviewing SOC 1/SOC 2 reports and assessing vendor/subservice organization risk
- Strong track record managing external audit and/or co-source relationships
- Proficiency with audit management software, compliance platform, ERP system, cloud productivity suite, major large language model providers, CRM system, and HR system
- Strong written and verbal communication skills, with the ability to explain technical control concepts to non-technical stakeholders
- A high degree of ownership and comfort building process where none exists