Head of IT Audit

Lead complex Information Technology and Cybersecurity audits and other general system and application controls, IT processes, project management and data integrity audit projects/initiatives utilizing information technology control frameworks, such as ITIL, COBIT, and FFIEC, or other relevant regulatory guidance, e.g., NYSDFS 500, etc., where applicable., * Effectively prepare a well-developed risk based audit approach related to Information and Cybersecurity, Data Protection, Business Continuity Management, Physical Data Security and other relevant information technology areas, while ensuring alignment to current regulatory (e.g. FFIEC, NYSDFS 500, etc.) requirements and emerging risks and regulatory expectations.

• Proactively lead in the development of the information technology Risk Assessment of the audit universe and development of the Audit Plan, while taking in account IT audit standards and frameworks, e.g., ITIL, COBIT, FFIEC, ISO 17799, ISO/IEC 27002, etc.; data security and privacy regulations; infrastructure and related technologies.
• Stay abreast of industry IT trends to identify potential issues and risks, as well as relevant best practices, laws, rules and regulations impacting financial institutions and ensuring that the changes are incorporated into the risk assessment process.
• Execute high value IT audits, identify risks, assess mitigating controls, determine “root causes” and make value-add recommendations to improve the control environment through well developed audit reports;
• Leverage knowledge of systems and data and perform and document all reviews in a manner consistent with acceptable professional standards, including supporting audit procedures, findings and results; and,
• Manage the audit issues follow-up process, review evidence of closure of findings and determine that evidence of remediation is appropriate to effectively mitigate the risks raised.
• Participate in department-wide initiatives, audit new product processes and new systems and perform other duties as assigned., * Pregnant individuals and/or individuals with pregnancy or childbirth-related medical conditions.
• Victims of domestic violence, sex offenses or stalking.
• Employees with religious observance and practice obligations.

Any employee who believes he or she needs an accommodation for any of the above reasons should contact their supervisor or a member of Human Resources to request such an accommodation. In each case, the Bank will engage in a good faith written or oral dialogue concerning the individual’s accommodation needs; potential accommodations that may address the individual’s accommodation needs, including alternatives to a requested accommodation; and the difficulties that such potential accommodations may pose for the employer. The Bank retains the ultimate discretion to choose the appropriate reasonable accommodation. Upon reaching a final determination at the conclusion of the cooperative dialogue, the Bank will provide the requesting individual with a written final determination identifying any accommodation granted or denied. In addition, the Bank will maintain any information regarding the employee’s request and status in the strictest confidence, except as requested by the employee, as required on a need-to-know basis or as otherwise required by law. Disclaimer The above statements are intended to describe the general nature and level of work being performed by people assigned to this classification. They are not to be construed as an exhaustive list of all responsibilities, duties, and skills required of personnel so classified. All personnel may be required to perform duties outside of their normal responsibilities from time to time, as needed. All your information will be kept confidential according to EEO guidelines.

• Approximately 15+ years of advanced professional auditing or comparable experience in a banking environment that provides exposure to progressive audit techniques, sophisticated information systems, network security, technology infrastructure, software development, project management, or a related field for which Internal Audit has a need.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science or a related field is required.
• In-depth knowledge of developing and implementing cybersecurity, privacy, and IT risk strategies in the areas of operational cybersecurity, privacy and/or IT risk knowledge and other related areas in order to assist management in continuous program improvement.
• Advanced understanding of concepts related to information systems audit, including security and control risks such as information security, logical and physical access security, change management, business recovery practices and network technology.
• Expert knowledge of IT related regulatory environment and applicable banking regulations.
• Expert knowledge of control objectives for information and related technology, accepted auditing standards, standards for the Professional Practice of Internal Auditing.
• Demonstrated ability to adapt quickly to changing demands and environment and rapidly develop in-depth knowledge of new audit areas.
• Excellent verbal and written communication skills and ability to comfortably interact with all levels of management and Board level committees.
• Ability to employ appropriate tools to enhance the audit process.

At least two of the following Certifications is strongly preferred, or equivalent: *

• Certified Information System Auditor (CISA)
• Certification specific to the information technology industry such as, Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), Certified Information Privacy Professional (CIPP), Certified in the Governance of Enterprise IT (CGEIT), Certified Information Security Manager (CISM).

The expected annual salary for this position is between $200,000 and $250,000 at the start of employment. A salary offer is determined on an individualized basis, taking into consideration factors such as an individual’s skills and experience. In addition to base salary, our total rewards package also includes eligibility for an annual bonus, medical, pharmacy, dental, and vision plans, life and disability insurance, employee wellness program, retirement and savings plans with employer contributions, generous holiday and paid time off schedules, parental leave, and tuition reimbursement.