Internal IT Auditor, Senior

Your Role

The Senior Internal IT Auditor leads and executes audit engagements, serving as a subject matter resource and ensuring high-quality audit delivery across technology and cybersecurity domains.

Responsibilities

Your Work

In this role, you will:

• Be responsible for performing and leading transactional quality review audits with limited or no supervision
• Have expert knowledge of transactional quality assurance audit principles and methodology; considered a subject matter expert in multiple functional areas
• Support risk assessments and development of audit plans for data and AI governance areas
• Review controls over AI-enabled business processes, including data sourcing, model outputs, decisioning logic, and human oversight mechanisms
• Leads corrective/ preventive action planning related to transactional audits
• Assess design and operating effectiveness of controls related to intellectual property (IP) protection, including source code repositories, model artifacts, proprietary algorithms, and data assets
• Perform audits of DevSecOps pipelines, including CI/CD tooling, automated testing, code promotion, and segregation of duties across development environments
• Evaluate risks related to use of open-source software, third-party libraries, and external AI services, including licensing compliance, security vulnerabilities, and data leakage
• Analyze risks associated with data used in software and AI development, including data governance, quality, lineage, privacy, and regulatory compliance (e.g., HIPAA data considerations)
• Assess AI governance frameworks, including intake, approval, ethical review, monitoring, incident management, and model retirement processes
• Research issues and shares the findings of that work with varying groups effectively (executives, managers, line staff, etc.). Messaging is appropriate to audience
• Develop and maintains productive client and staff relationships through individual contacts and group meetings
• Be proficient in either operational, financial or IT auditing, but not yet an expert. Work still needs oversight to be released and reviewed by Management
• Work to achieve operational targets with direct impact on BSC departmental results
• Work independently under limited supervision
• Be responsible for entire projects or processes within BSC annual audit program
• Communicate with parties within and outside of BSC with the ability to educate others on complex disciplines
• May have responsibility for communicating with parties’ external to the organization (e.g., customers, vendors, etc.)
• Works to influence parties within and outside of the BSC at an operational level regarding policies, practices, and procedures
• Stay updated on data and AI trends, technologies, and regulations, applying insights to audit engagements and supporting the education of data and AI risks and controls to audit teams

Qualifications

Your Knowledge and Experience

• Requires a Bachelor’s degree or High School Diploma/GED and 4 years of additional relevant experience in lieu of a degree
• Requires a minimum of 5 years of prior relevant experience
• Basic competence and knowledge with support from others of: Financial Accounting and Finance Concepts, Managerial Accounting, Regulatory, Legal and Economics, Quality Framework, Ethics and Fraud, Information Technology, Governance, Risk and Controls, Organizational Theory and Behavior
• Working knowledge of AI tools, models, and platforms (e.g., generative AI, ML systems), including associated risks, controls, and governance consideration
• Strong analytical and problem-solving skills
• Typically, requires advanced knowledge of auditing typically obtained through advanced education combined with experience. May have practical knowledge of project management
• Familiarity with frameworks such as COBIT, NIST, ISO, or HIPAA
• Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), Certified Information Systems Security Professional (CISSP), Certified Internal Auditor (CIA) and/or Certified Secure Software Lifecycle Professional (CSSLP) desired
• Experience in software development, including SDLC methodologies (Agile, DevOps, CI/CD) and modern engineering practices
• Familiarity with secure coding practices, code management tools (e.g., Git-based repositories), and application security controls
• Understanding of data governance and data protection principles, including privacy, confidentiality, regulatory compliance, and intellectual property management
• Experience auditing or implementing AI governance frameworks (e.g., NIST AI RMF, internal AI governance programs)
• Experience with AI/ML model risk management, including validation, bias detection, explainability, and monitoring
• Familiarity with secure AI development practices and emerging AI risk domains (prompt injection, data poisoning, model leakage, etc.)
• Experience in the management, governance, and control of Artificial Intelligence (AI) use
• Experience in regulated environments (e.g., healthcare)

Hybrid

This role requires employees to be in-office based on our hybrid workplace model, balancing purposeful in-person collaboration with flexibility. For most teams, this means coming into the office two days each week. Employees living more than 50 miles from an office location will work with their manager to determine in-office time based on business need.