IT Auditor - Program Manager, GRC

We’re a leader in data and AI. Through our software and services, we inspire customers around the world to transform data into intelligence - and questions into answers.

We’re also a debt-free multi-billion-dollar organization on our path to IPO-readiness.

If you're looking for a dynamic, fulfilling career coupled with flexibility and world-class employee experience, you'll find it here.

We’re looking for an IT Auditor
- Program Manager, GRC - A, that will help conduct audits to ensure internal controls are in place that align with various regulations (which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53) as well as the policies and procedures set forth by SAS. A secondary focus is to operate in a compliance role, assist in the risk program, and facilitating remediation of continuous improvement efforts across the business.

• Lead internal audits by:
  • Benchmarking of security policies against best practices and standards, which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53.
  • Creating and executing on audit test cases and managing work papers and evidence
  • Developing and presenting Audit Reports
• Lead efforts to formalize and mature the Audit Program at SAS
• Use the Service Now IRM tool to create and manage continuous monitoring indicators, build reporting dashboards, document electronic work papers, and manage audit documentation
• Perform issue remediation tasks such as analysis, documentation, follow-up and retesting in response to audit findings.
• Operate as a consultant, researching and recommending changes to enhance or streamline quality and information security procedures, including internal and external auditing.
• Review hosting, security, and audit contract terms and ensure compliance to current policies and processes.
• Help maintain the IT and security policy and process development and updates, while ensuring compliance with regulatory regulations and guidance.
• Assist in conducting Risk Assessments, including participation in risk workshops with subject matter experts where vulnerabilities and threats are discussed in association with likelihood and probability factors.
• Coordinate response to complete RFP and security questionnaires.
• Perform other duties, as assigned.

• Bachelor's degree in Business, IT, Computer Scienceor related field
• 5-8 years of experience in an audit, compliance, risk or governance-related functions
• Knowledge of Risk-based auditing methodologies and audit procedures
• Auditor certification strongly preferred, such as CISA
• Must have the ability to work with little supervision, escalating issues, as appropriate
• US Citizenship required
• You’re curious, passionate, authentic and accountable. These are ourvalues and influence everything we do.

• Understanding of best practices for information security and data privacy
• Knowledge and experience with best practices /standards: ISO 27001, ITIL, or COBIT
• Understanding of regulatory standards: PCI,FISMA/NIST 800-53, or IRS 1075
• Experience with a GRC System and Electronic Work papers
• Experience with Service Now issue management ticketing system (Preferably IRM)
• SAS software implementation experience or prior implementation experience
• Knowledge of IT, project management, compliance or quality auditor procedures and tools (not financial/accounting)
• IT hosting experience

Highlights include...

• Comprehensive medical, prescription, dental and vision plans.
• Medical plan options include:
  • PPO with low annual deductible and copays.
  • HDHP combined with a health savings account with a contribution from SAS (no access to on-site health care center).
• Onsite Health Care Center (HQ) that’s free to employees and…