IT​/Operations Auditor - Internal Compliance

Posting Details

Position Title: IT/Operations Auditor - Internal Compliance

Position Type: Regular

Job Number: SA81424

Full or Part Time: full-time, 40 hours weekly

Fair Labor Standard Act Classification: Exempt

Anticipated Pay Range: $90,000 - $110,000

Pay Range Information: Chapman University is required to provide a reasonable estimate of the compensation range for this position. This range takes into account a variety of factors that are considered in making compensation decisions, including experience, skills, knowledge, abilities, education, licensure and certifications, and other business and organizational needs. Salary offers are determined based on the final candidate’s qualifications and experience, as well as internal equity and other internal factors.

The anticipated pay range is not a promise of a particular wage.

Job Description

Summary:

The IT Auditor supports the Internal Audit function by performing risk-based audits and assessments across both technology and operational areas, with an expected 50/50 split between IT/cybersecurity audits and operational audits. On the IT side, the role evaluates general IT controls (ITGCs), application controls, identity and access management, infrastructure and cloud environments, system development and change management, third-party/vendor controls, data protection practices, and the accuracy and reliability of dashboards and reporting used for decision-making.

On the operational side, the role participates in audits of University departments and processes to evaluate internal controls, compliance with policies and procedures, and opportunities to improve effectiveness and efficiency. The position develops clear, well-supported work papers and reporting, communicates findings and practical recommendations, and tracks remediation to closure. As part of assigned audit engagements, the position may perform audits or assessments of AI-enabled tools and processes by evaluating governance and control practices (e.g., data protection, accuracy, access controls, and vendor oversight) and may assist the department in identifying responsible ways to use AI to improve efficiency and consistency across audit and compliance work.

The position maintains independence, objectivity, integrity, and confidentiality consistent with Internal Audit standards.

• Perform IT audits and assessments under the direction of Internal Audit leadership, including scoping, risk assessment, process documentation, control evaluation (design and operating effectiveness), and maintaining well-supported work papers.
• Test IT general controls and application controls (e.g., access, change management, operations, backup/recovery) and use data analytics where appropriate to identify anomalies and trends.
• Validate dashboards and report data by tracing key metrics to source systems, assessing data definitions and transformation logic, and documenting results to support audit conclusions and stakeholder reporting.
• Communicate findings to stakeholders, develop practical recommendations, and track management action plans, timelines, and evidence of completion through remediation and closeout.
• Summarize risks, findings, and recommendations; maintain issue tracking and provide periodic status reporting on open remediation items.
• As part of assigned audits, review third-party assurance (e.g., SOC reports) and vendor security documentation and evaluate whether contractual control requirements are defined and monitored; communicate gaps and recommendations to management for remediation.
• As part of assigned audits, evaluate the design and operating effectiveness of cybersecurity governance and key controls (e.g., access management, configuration/change control, incident response readiness, and logging/monitoring) and communicate observations and recommendations to management.
• As part of assigned audits, evaluate governance and controls over the use of Artificial Intelligence (AI)-enabled tools and processes (e.g., data protection, access controls, vendor oversight, and monitoring/quality controls) and communicate control gaps and recommendations to management.
• Assis…