IT Security Audit Manager

Job Summary:

The IT Security Audit Manager / Lead Auditor is responsible for leading and managing SEC530 security compliance audits across multiple systems, acting as the primary liaison for internal audit leadership. This role oversees audit planning, execution, evidence review, findings development, and reporting to ensure compliance with relevant standards and regulations. Responsibilities:

• Develop and maintain project plans, integrated audit schedules, evidence request lists, and system-specific SEC530 audit programs.
• Serve as the primary client contact, leading entrance conferences, weekly status updates, evidence coordination, findings reviews, and exit conferences.
• Determine control applicability across 109 system-specific controls, identify controls for scope exclusion, and approve risk-based sampling approaches.
• Review audit evidence and work papers for completeness, sufficiency, and reliability.
• Validate access-termination testing for contractor accounts to ensure timeliness.
• Develop and validate audit findings using the client s risk-rating methodology.
• Prepare and finalize draft and final audit reports; manage corrective action plan processes.
• Oversee secure evidence repository management and coordinate reliance on SOC 2 reports for relevant systems.
• Ensure compliance with SEC530, SEC502, SEC520, NIST SP 800-53, and GAGAS/IIA standards.
• Manage overall engagement risk, escalation procedures, and change control.

Required Skills & Certifications:

• 10+ years of experience in IT audit, cybersecurity assurance, technology risk, or compliance.
• 5+ years of experience leading IT security or system compliance audits, including fixed-price deliverable-based engagements.
• Demonstrated knowledge of SEC530, SEC502, and/or SEC520 standards.
• Experience with NIST SP 800-53 control assessments and vendor-managed/shared-responsibility controls (SOC 2 reliance).
• Proficiency in preparing audit programs, work papers, findings, corrective action plans, and final reports for government or regulated clients.
• Understanding of GAGAS or IIA Global Internal Audit Standards.
• Strong project, schedule, risk, and stakeholder management skills across concurrent audits.
• Experience with third-party and SaaS risk assessment including SOC 2 evaluations.

Preferred Skills & Certifications:

• Experience auditing asset management/ITSM platforms, SaaS collaboration tools, or VoIP/call-recording systems.
• CISA or CISSP certification preferred but not required.
• PMP certification is desirable.
• CIA or CRISC certification is desirable.

Special Considerations:

• Role requires managing multiple concurrent audits with strict adherence to regulatory standards.
• Must handle sensitive audit evidence securely using designated repositories.
• Coordination with various stakeholders and adherence to risk escalation and change management protocols are essential.

Scheduling:

• Work schedule may involve managing overlapping audit engagements and coordinating with internal and external stakeholders.
• Flexibility to accommodate audit timelines and reporting deadlines is expected.