Senior internal auditor, IT Audit

Now Brewing – Senior IT Internal Auditor! #tobeapartner

From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others.

This job contributes to Starbucks success by planning and performing audits of technology and operational data and processes to verify compliance with established standards and controls, and to identify process improvement opportunities. Models and acts in accordance with Starbucks guiding principles.

A successful senior IT internal auditor at Starbucks is a self-starter, adept at solving problems, and able to collaborate with business stakeholders effectively. You should have strong problem‑solving and communication skills, and a solid track record of evaluating technology controls and IT SOX.

• With the support of an Audit Project Lead, perform end‑to‑end IT audit assessments, including test planning, scoping, fieldwork, and reporting
• Independently conduct audit walkthroughs, document business processes and procedures, analyze audit evidence, and identify deficiencies
• Assess the design and operating effectiveness of application, infrastructure, and security controls across complex on‑premise and cloud environments
• Evaluate technology risks related to cybersecurity, system implementations, software development lifecycle controls (SDLC), data privacy, and third‑party risks
• Support and execute SOX 404 IT control testing, including coordination with external auditors and management, and SOX 302 IT procedures
• Translate, in common English, key internal and external IT risks, deficiencies, and trends
• Support creation of audit reports and closing meeting materials and assist with project wrap‑up
• Follow up on issue remediation progress, including validating remediation details
• Coordinate and communicate engagement and initiative status

• 3 years of progressive experience in IT Audit, IT Risk Management, or Technology compliance, or 2 years of IT Audit experience with a Big-4 professional services firm.
• Demonstrated knowledge of internal IT controls, risks, environments, and test procedures
• Ability to independently execute audit tests and evaluations with high efficiency and quality
• Hands‑on experience performing IT General Controls and SOX 404 IT audit work in a public company or large corporate environment.
• Ability to communicate clearly and concisely, with experience presenting audit conclusions to management
• Bachelor’s degree in Accounting, Management Information Systems (MIS), Information Systems, Computer Science, Information Technology, or related field

• Experience in a Big-4 professional services firm, or Internal Audit functions in Fortune 500, large multinational firms with complex technology environments
• Professional certifications (CISA strongly preferred); CISA, ISO 27001 Lead Auditor, CISSP, CISM, CIA
• Previous experience auditing Cloud platforms (AWS, Azure, GCP), SaaS ecosystems, or product‑driven tech stacks
• Previous experience auditing cybersecurity controls (network, host, database, cloud layers)
• Proficiency in data analysis tools
• Familiarity with Generative AI techniques to drive efficiencies in audit execution

• Ability to perform risk assessments, design and execute risk‑based audit programs, evaluate control design and operating effectiveness
• Deep understanding of IT General Controls (ITGC), Application controls, SDLC and change management processes, Information security concepts (IAM, encryption, vulnerability management, networks)
• Familiarity with leading IT frameworks and standards such as NIST 800-53, ISO 27001, SOC 1 / SOC 2
• Experience supporting and coordinating with external auditors
• Strong attention to detail and accuracy while working under tight deadlines
• Comfort interacting with IT Engineering, Cybersecurity teams, Product teams, and External auditors
• Capability to translate technical concepts into clear, business‑focused risk…