Senior IT Audit Specialist

About the Job:

The IT Audit Senior Specialist will be responsible for supporting the planning, execution, and reporting of information technology and cybersecurity audits. This role contributes to risk-based audit work by evaluating IT processes, assessing control design and operating effectiveness, documenting results, and communicating observations and recommendations in a clear, accurate, and professional manner.

What You'll Do:

• Serves as a contributing team member on technology, cybersecurity, and integrated audits under the direction of more experienced audit professionals.

• Supports audit planning by helping understand business and technology processes, identify relevant risks, develop audit objectives, and define appropriate testing procedures.

• Evaluates the design and operating effectiveness of controls that manage technology, cybersecurity, operational, regulatory, and financial reporting risks.

• Performs audit testing across common IT control areas, such as access management, change management, system development, configuration management, data integrity, backup and recovery, business continuity, logging and monitoring, and third-party or cloud-related controls.

• Prepares clear, logical, well-supported, and accurate workpapers that document procedures performed, evidence reviewed, conclusions reached, and any identified exceptions.

• Drafts audit observations and issue content that clearly explain the condition, risk, root cause, and recommended corrective action, consistent with department guidelines.

• Applies working knowledge of audit standards, risk and control concepts, and technology processes to evaluate control gaps and support audit conclusions.

• Communicates audit status, testing results, potential issues, and recommendations to audit team members, business stakeholders, and IT management in both technical and non-technical terms.

• Demonstrates effective interviewing, inquiry, and note-taking skills to understand processes, clarify assumptions, validate evidence, and support audit conclusions.

• Manages assigned audit work across one or more concurrent audits by meeting deadlines, escalating questions or concerns timely, and adjusting to changing priorities.

• Builds business, technology, cybersecurity, and project management knowledge through audit work, stakeholder interaction, self-directed learning, and professional development.

• Uses data, reporting, and analytic tools, where applicable, to support audit testing, improve efficiency, and develop deeper insight into risk and control effectiveness.

What You'll Bring to the Role:

• Bachelor’s degree in Management Information Systems, Information Technology, Cybersecurity, Risk Management, Accounting, Finance, Business, or a related field.

• Three or more years of experience in IT audit, cybersecurity audit, internal audit, compliance, technology risk, technology operations, or a related field.

• Strong written and verbal communication skills, with the ability to document audit work clearly and communicate effectively with technical and non-technical stakeholders.

• Working knowledge of IT audit concepts, risk and control principles, and common audit standards or frameworks, such as COBIT, NIST, ISO, ITIL, IIA Standards, or similar frameworks.

• Solid understanding of general IT control topics, including logical access, change management, system development, configuration management, data integrity, encryption, retention and disposal, backup and recovery, business continuity and disaster recovery, logging and monitoring, and vulnerability or security management.

• Ability to analyze information, identify control gaps, support conclusions with evidence, and communicate the business or technology risk in a practical and understandable way.

• Strong organization and time management skills, with the ability to manage multiple assignments, meet deadlines, and produce high-quality work.

• Demonstrated curiosity and willingness to continue developing technical knowledge, audit skills, business acumen, and project management capabilities.

• Ability to work effectively in a team environment, receive feedback, collaborate with audit colleagues, and build productive relationships with stakeholders.

• Willingness to obtain or actively work toward a relevant professional certification, such as CISA, CISSP, CIA, CRISC, CISM, CPA, or a similar credential.

• Experience with a large corporate internal audit function, public accounting firm, consulting firm, financial services organization, or regulated environment preferred.

• General understanding of Model Audit Rule, SOX, IT general controls, cybersecurity controls, or regulatory-driven audit work preferred.

Compensation Range:

Pay Range - Start:

Pay Range - End:

Geographic Specific Pay Structure:

Structure 110:

Structure 115:

We believe in fairness and transparency. It’s why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you’re living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.

Grow your career with a best-in-class company that puts our clients' interests at the center of all we do. Get started now!

Northwestern Mutual is an equal opportunity employer that welcomes talented individuals of all backgrounds. We are committed to creating and maintaining an environment in which each employee can contribute creative ideas, seek challenges, assume leadership and continue to focus on meeting and exceeding business and personal objectives.

FIND YOUR FUTURE

We’re excited about the potential people bring to Northwestern Mutual. You can grow your career here while enjoying first-class perks, benefits, and our commitment to a culture of belonging.

• Flexible work schedules
• Concierge service
• Comprehensive benefits
• Employee resource groups