IT Security Audit Manager

The IT Security Audit Manager / Lead Auditor is responsible for leading and managing SEC530 security compliance audits across multiple systems, acting as the primary liaison for internal audit leadership. This role oversees audit planning, execution, evidence review, findings development, and reporting to ensure compliance with relevant standards and regulations. Responsibilities:

• Develop and maintain project plans, integrated audit schedules, evidence request lists, and system-specific SEC530 audit programs.
• Serve as the primary client contact, leading entrance conferences, weekly status updates, evidence coordination, findings reviews, and exit conferences.
• Determine control applicability across 109 system-specific controls, identify controls for scope exclusion, and approve risk-based sampling approaches.
• Review audit evidence and work papers for completeness, sufficiency, and reliability.
• Validate access-termination testing for contractor accounts to ensure timeliness.
• Develop and validate audit findings using the client s risk-rating methodology.
• Prepare and finalize draft and final audit reports; manage corrective action plan processes.
• Oversee secure evidence repository management and coordinate reliance on SOC 2 reports for relevant systems.
• Ensure compliance with SEC530, SEC502, SEC520, NIST SP 800-53, and GAGAS/IIA standards.
• Manage overall engagement risk, escalation procedures, and change control., * Role requires managing multiple concurrent audits with strict adherence to regulatory standards.
• Must handle sensitive audit evidence securely using designated repositories.
• Coordination with various stakeholders and adherence to risk escalation and change management protocols are essential.

Scheduling:

• Work schedule may involve managing overlapping audit engagements and coordinating with internal and external stakeholders.
• Flexibility to accommodate audit timelines and reporting deadlines is expected., Senior Staff Auditor, Bank and Support Functions Audit (Hybrid) The Internal Audit function within Capital One is a dedicated group of audit professionals focused on delivering t…
• 1 month ago, Job Summary: The Senior IT Security Auditor / Technical Security SME is responsible for performing hands-on security control testing and technical evidence analysis across Lanswe…
• 15 hours ago
• Apply easily +

• 10+ years of experience in IT audit, cybersecurity assurance, technology risk, or compliance.
• 5+ years of experience leading IT security or system compliance audits, including fixed-price deliverable-based engagements.
• Demonstrated knowledge of SEC530, SEC502, and/or SEC520 standards.
• Experience with NIST SP 800-53 control assessments and vendor-managed/shared-responsibility controls (SOC 2 reliance).
• Proficiency in preparing audit programs, work papers, findings, corrective action plans, and final reports for government or regulated clients.
• Understanding of GAGAS or IIA Global Internal Audit Standards.
• Strong project, schedule, risk, and stakeholder management skills across concurrent audits.
• Experience with third-party and SaaS risk assessment including SOC 2 evaluations.

Preferred Skills & Certifications:

• Experience auditing asset management/ITSM platforms, SaaS collaboration tools, or VoIP/call-recording systems.
• CISA or CISSP certification preferred but not required.
• PMP certification is desirable.
• CIA or CRISC certification is desirable.

• $96,500-110,100 per year