Internal Audit Manager - Technology Risk

You will support the delivery of the Annual Audit Plan for technology risk and manage the governance of controls in place to comply with ISO 27001 and corporate policies without sacrificing the effective and efficient use of corporate resources. Specific responsibilities include:

• Reviewing new systems, manuals, software, procedures, records and management controls for their adequacy to accomplish intended objectives, and recommend improvements to ensure that new initiatives achieve company objectives.
• Performing complex technical audit reviews, which require a higher level of audit expertise or skills.
• Planning and reviewing audits in a professional manner, ensuring that major risk areas are addressed.
• Participating in annual risk assessment and audit planning.
• Supervising audit employees on a continuous basis in various ways such as monthly employee scheduling, monitoring progress of audit reviews, etc. to ensure that audits are completed on a timely basis, in accordance with departmental standards and audit program.
• Creating audit reports and presenting to management teams covering the output of audit activity, discussing deficiencies and recommending ways to improve and obtain management agreement to take corrective actions.

• Bachelor's degree in computing science, management information systems, engineering or accounting.
• Professional audit / security certifications (at a minimum one or two): CISSP, GSNA, GSEC, CISA, ISO 27001 Auditor/Lead Auditor. Secondary certifications (a plus): MCSE, ITIL, Unix, Red Hat, CEH, CIA.
• Minimum 5-7 years progressive IT audit experience.
• Strong working knowledge in security controls for various operating systems, databases, ERP systems, and application systems.
• Strong working knowledge of ACL and/or other analytical tools for data analysis.
• Expert knowledge in eCommerce systems, networking systems, network and internet security, and VoIP technology.
• Strong working knowledge of industry best practices in backup procedures for different infrastructure levels, recovery procedures and disaster recovery.
• Working knowledge of change management procedures for the different levels of technology infrastructure.
• Working knowledge of ISO 27001 and PCI-DSS security standards, COBIT and Val IT.