Senior Auditor - IT

Changing lives. Building Careers.

Joining us is a chance to do important work that creates change and shapes the future of healthcare. Thinking differently is what we do best. To us, change equals opportunity. Every day, our colleagues are challenging what’s possible and making headway to innovate new treatment pathways to advance patient outcomes and set new standards of care.

The Senior Auditor - IT is responsible for executing complex risk-based IT audits, IT SOX testing, and advisory activities across enterprise systems, infrastructure, applications, and technology-enabled business processes. This role evaluates the design and operating effectiveness of IT general controls, application controls, cybersecurity, data governance, change management, and emerging technology controls, including the governance, security, and responsible use of artificial intelligence and automation tools.

The Senior Auditor - IT documents results in accordance with Internal Audit methodology and partners with stakeholders to identify practical remediation actions that strengthen the risk and control environment.

KEY RESPONSIBILITIES Audit Execution & Methodology Execute assigned IT audits and advisory reviews in accordance with the annual audit plan, Internal Audit methodology, and applicable professional standards.

Develop risk-based audit work programs, perform walkthroughs, evaluate control design, and complete testing to assess operating effectiveness.

Prepare clear, complete, and well-supported work papers, including narratives, flowcharts, testing results, and evidence of review-ready conclusions.

IT SOX & Control Testing Perform IT SOX testing for IT general controls, application controls, key reports, interfaces, privileged access, change management, and computer operations.

Assess control deficiencies, document potential impact, support severity evaluation, and communicate results to audit leadership and process owners.

Coordinate with management, external auditors, and control owners to support timely evidence requests, testing schedules, and remediation follow-up.

Risk Assessment, Findings & Remediation Support IT risk assessments by identifying key technology, cybersecurity, data, third-party, and operational risks relevant to audit scope and business objectives.

Analyze exceptions, identify root causes, and draft practical, risk-based recommendations that are clear, actionable, and aligned with management accountability.

Track remediation activities, validate corrective actions, and escalate delays or recurring issues to audit leadership as appropriate.

Technology, Cybersecurity & Project Reviews Evaluate controls across enterprise applications, cloud platforms, infrastructure, identity and access management, cybersecurity, data privacy, and business continuity processes.

Participate in pre- and post-implementation reviews for significant system changes, technology initiatives, and process transformations.

Assess risks and controls related to emerging technologies, including artificial intelligence, machine learning, automation, and data-driven tools, with focus on governance, access, data integrity, model oversight, and responsible use.

Apply relevant frameworks and standards, such as COBIT, NIST, ISO 27001, COSO, and ITIL, when assessing control design and risk coverage.

Analytics, Automation & Continuous Improvement Leverage analytics, automation, and AI-enabled tools to improve audit planning, testing efficiency, exception analysis, documentation quality, and continuous monitoring, while maintaining appropriate professional judgment and confidentiality.

Identify opportunities to simplify testing, improve documentation quality, and increase consistency across audit work papers and Audit Board records.

Stakeholder Engagement & Communication Build effective working relationships with IT, Finance, business process owners, and external auditors to facilitate timely audit execution and constructive issue resolution.

Communicate audit status, requests, observations, and recommendations clearly and professionally through meetings, work papers, and draft report language.

Prepare concise summaries of audit results for review by audit leadership, including risk implications, root cause themes, and management action plans.

Collaboration & Professional Development Demonstrate sound judgment, accountability, integrity, and attention to detail while managing multiple priorities and deadlines.

Maintain current knowledge of IT audit practices, SOX requirements, cybersecurity risks, emerging technologies, and relevant professional standards.

REQUIRED SKILLS & MINIMUM QUALIFICATIONS

Education:

Bachelor’s degree in Information Technology, Computer Science, Accounting, or related field.

Certifications:

CISA required. CIA/CPA a plus.

Experience:

5+ years IT audit / IT SOX experience (pharma/med tech industry experience preferred).Include relevant skills such as:

Expertise in ITGCs, application controls, cybersecurity, and risk frameworks; proficiency with…