Develop and carry out a risk-based internal audit plan for IT operations, security controls, and compliance processes
Conduct audits from planning through reporting, evaluating the effectiveness of IT controls, policies, and procedures
Identify control gaps and IT-related risks during audits and recommend actionable improvements
Prepare clear audit findings reports and work with stakeholders on remediation plans
Track audit findings and drive remediation efforts to closure with accountable owners
Work closely with IT, Security, Engineering, and other teams to gather evidence and facilitate audit processes
Serve as a liaison with external auditors and internal teams for any audit inquiries or compliance assessments
Support external compliance audits and certifications (e.g. ISO 27001, SOC 2) by providing required documentation and coordinating audit logistics
Maintain comprehensive audit workpapers and documentation repositories using a modern GRC tool
Help build audit playbooks and improve audit workflows to increase efficiency

University degree in Information Systems, Computer Science, MIS, or a related field
Professional certification such as CISA (Certified Information Systems Auditor) or CIA strongly preferred
5+ years of experience in IT auditing, IT risk, or related compliance fields
Demonstrated experience leading or executing multiple IT audits end-to-end, including working with external or third-party auditors
Strong understanding of IT governance, security, and compliance frameworks (e.g. ISO 27001, SOC 2, NIST 800-53, Sarbanes-Oxley (SOX), GDPR)
Familiarity with cloud platforms and enterprise IT controls (AWS, Azure, O365, etc.)
Experience with GRC or audit management tools (e.g. AuditBoard, Drata, Vanta) is a plus
Excellent communication skills
Strong organizational and project management skills

Audit and Compliance Manager

Key skills