Internal Audit Lead - IT Systems and Controls

Internal Audit Lead – IT Systems and Controls

We are seeking an experienced Internal Audit Lead – IT Systems and Controls to join our Internal Audit function, reporting directly to the Head of Internal Audit. This role will take ownership of SOX IT controls testing and assurance activities, with a strong emphasis on IT General Controls (ITGCs), IT Automated Controls, and Key Report testing. In addition, the role will contribute to broader IT and data-focused internal audit projects and advisory initiatives, driving value-added insights and strengthening the overall governance and internal controls environment.

This is a leadership level role that combines hands-on testing and evaluation with leadership, oversight, and stakeholder engagement.

Responsibilities include:

• Leading the planning, execution, and oversight of SOX testing for IT General Controls (ITGCs), IT Automated Controls, and Key Reports
• Assisting in the annual IT SOX scoping and risk assessment process in alignment with the overall ICFR and SOX program.
• Conducting and leading walkthroughs and design/effectiveness testing of IT controls across homegrown and third-party systems
• Coordinating evidence collection, managing remediation efforts, and ensuring timely closure of audit gaps.
• Overseeing the work of co-sourced as well as internal team members and reviewing their work to ensure high-quality, consistent results.
• Identifying control deficiencies and working with management to design effective remediation approaches and measures.
• Monitoring changes to business processes and applying independent judgment to evaluate the potential impact to the control environment and recommend necessary improvements. Presenting the impact of the changes to the Head of Internal Audit and other stakeholders prior to implementation.
• Managing and updating all ICFR/SOX 404 documentation as required including COSO framework mapping, process and control narratives/flowcharts, risk and controls matrix, and testing approach.
• Applying professional skepticism and subject matter expertise to independently evaluate and conclude on control deficiencies and develop the necessary remediation actions and monitor their implementation in due time.

Additionally, the role involves:

• Leading and delivering internal audit projects focused on IT, data governance, and emerging technology risks with a primary focus on internal controls for financial reporting and SOX.
• Providing advisory services to technology and business leaders on IT risk management, control optimization, and compliance matters.
• Evaluating data integrity, system development practices, access management, and change management processes.
• Working closely with engineering, and IT teams to design and implement effective and scalable IT controls.

The role also includes:

• Identifying, assessing, and documenting control deficiencies, including evaluation of severity and impact.
• Working with cross-functional leadership and process owners to develop, track, and validate timely remediation plans.
• Recommending process improvements and efficiency opportunities while maintaining control effectiveness.

Stakeholder collaboration and communication responsibilities include:

• Acting as the key liaison with IT, Engineering, Security, finance, and business system teams for IT SOX and assurance initiatives.
• Partnering with external auditors to coordinate IT SOX testing approaches and reliance strategies.
• Providing training and guidance to IT and business stakeholders on IT control requirements and best practices.
• Preparing reports and presentations summarizing IT SOX results, audit findings, and remediation progress for the Head of Internal Audit and Audit Committee.
• Communicating complex IT control issues in a clear, business-oriented manner to senior management and stakeholders.
• Monitoring industry and regulatory developments, advising leadership on emerging IT and data-related risks.

Qualifications include:

• Education & Certification:
  Bachelor's degree in Information Systems, Computer Science, Accounting, or related field. CISA, CISSP, or equivalent certification strongly preferred; CPA or CIA is a plus.
• Experience:
  
  10+ years of progressive experience in IT audit, IT risk, or IT SOX compliance, with at least 3+ years in a managerial or supervisory level role. Big Four accounting firm or equivalent experience in Internal or External Audit or IT consulting practice.
• Deep expertise in ITGCs, IT Automated Controls, key report testing, and their relevance to ICFR, Internal audit methodology and IIA standards.
• Experience auditing or testing both homegrown business systems and third-party SaaS applications.
• Familiarity with data governance, system implementation reviews, and cybersecurity risk assessments.
• Experience of working with audit management tools (e.g., Audit Board, Archer, Workiva) to manage SOX and IT compliance programs.

Skills &

Competencies:

• Strong analytical and technical skills with the ability to evaluate IT and data risks across complex environments.
• Excellent…