Manager, IT Auditor

We are proud to be consistently recognized as one of the world’s best places to work, a champion of diversity and a model of social responsibility. Extraordinary teams are at the heart of our business strategy, but these don’t happen by chance. As a Manager, IT Auditor, you will hold a senior individual contributor role within the Internal Audit function, operating as part of the organization’s third line of defense. In this role, you will work closely with Global Internal Audit leadership, which reports directly into the Chief Risk Officer and the Board Risk Subcommittee. Your work will focus on providing independent assurance over the design and operating effectiveness of the organization’s technology processes and controls through risk-based audit engagements, delivering insights that help management strengthen technology processes, controls, and risk management practices.

Perform and lead assigned IT audit engagements across technology risk areas such as cybersecurity, cloud environments, AI and generative AI, third‑party risk, data governance, and IT operations. You will lead end‑to‑end audit engagements on a continuous or risk‑based cycle throughout the year, bringing strong IT audit knowledge and a risk‑based perspective to each engagement. Audit Planning & Execution

Lead assigned IT audit engagements within the approved annual audit plan, developing risk‑based audit procedures and testing approaches consistent with established audit methodology and risk priorities.

Assess the governance and controls around AI and generative AI tools (e.g., Claude, ChatGPT, Copilot), acceptable use, data privacy, model and vendor due diligence, human‑in‑the‑loop review, and output validation.

Design audit programs, end‑to‑end process walkthroughs, test procedures, and sampling strategies tailored to the risk profile of each engagement.

Test core IT general controls, covering logical access and periodic user access reviews, change and configuration management, IT operations and job scheduling, and backup and recovery.

Test cybersecurity controls, covering vulnerability and patch management, security monitoring and threat detection, identity and access security, and incident response readiness.

Audit data governance and oversight, including data ownership and stewardship, classification and retention, data quality controls, traceability and access rights, and the effectiveness of governance forums in exercising oversight over data use.

Review the software development lifecycle, including design approval, secure coding, testing and UAT, release management, segregation of duties, and post‑implementation review.

Present audit findings, recommendations, and status updates to senior internal management.

Provide guidance to stakeholders on IT audit findings, control effectiveness, and identified technology risks.

Collaborate with the first and second lines of defense to understand and support alignment on established control objectives and risk tolerances.

Reporting & Issue Management

Produce high‑quality internal audit reports with clear, risk‑rated findings and actionable recommendations.

Perform root‑cause analysis on control failures, distinguishing design gaps from execution breakdowns so remediation addresses the underlying process rather than the symptom.

Monitor remediation progress, assess management action plans, validate completion of agreed actions, and report status to relevant stakeholders.

Maintain audit documentation in accordance with IIA Standards and internal quality assurance requirements.

Coach and support team members during assigned audit engagements and provide feedback to promote consistent application of audit methodology.

Peer review workpapers and support consistent application of established audit methodology across assigned engagements.

Contribute to enhancements to IT audit tools, analytics, and audit practices, including appropriate use of AI‑enabled automation to support audit planning, testing, and reporting.

Deep understanding of IT risk, control frameworks, and audit methodology (IIA Standards, COSO, COBIT, NIST Cybersecurity Framework).

Strong knowledge of IT general controls and IT audit methodology, with working knowledge of cybersecurity, cloud risk, vendor management, and related technology risk areas sufficient to assess controls against established frameworks.

Practical experience auditing data governance and oversight frameworks, including data ownership, classification and retention, data quality, and data traceability.

Working knowledge of application development lifecycle and change management controls across waterfall, agile, and DevOps delivery models.

Familiarity with AI risk and governance frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) as applied to enterprise AI deployments.

Proficiency with analytics tools (SQL, Power BI, ACL/Galvanize) and AI assistants such as Claude or ChatGPT to support continuous auditing and automation.

Able to convey complex technical risk, in writing and verbally, to non‑technical audiences and manage stakeholders at all levels.

Able to coach colleagues and peer review workpapers, holding engagements to a consistent methodology and quality standard.

Bachelor’s degree in Information Technology, Computer Science, Accounting Information Systems, or a related field; 6-9 years of progressive experience in IT audit, cybersecurity, or IT risk management, including 2-3 years leading audit engagements end to end.

Prior experience in a Big 4, consulting firm, or regulated industry is a strong asset.

CISA - Certified Information Systems Auditor

CRISC - Certified in Risk & Information Systems Control

Cloud or cyber risk credentials (e.g., AI governance credentials (e.g., IAPP AIGP, ISO/IEC 42001 Lead Auditor)

Compensation for this role includes base salary, annual discretionary performance bonus, 401(k) plan with an annual employer contribution based on years of service and Bain’s best in class benefits package (details listed below).

Some local governments in the United States require a good‑faith, reasonable salary range to be included in job postings for open roles. In Georgia, the good‑faith, reasonable annualized full‑time salary range for this role is between $99,500 and $119,500.

In Massachusetts, the good‑faith, reasonable annualized full‑time salary range for this role is between $114,500 and $137,500.

In Texas, the good‑faith, reasonable annualized full‑time salary range for this role is between $104,500 and $125,500.

Placement within this range will vary based on several factors including, but not limited to experience, education, licensure/certifications, training and skill level.

Annual discretionary performance bonus

Bain & Company's comprehensive benefits and wellness program is designed to help employees achieve personal independence, protection and stability in the areas most important to you and your family.

Bain pays 100% individual employee premiums for medical, dental and vision programs, offering one of the most comprehensive medical plans for employees without impacting your paycheck

Generous paid time off, including parental leave, sick leave and paid holidays

Paid Life and Long‑Term Disability insurance

WORKING MODEL / TRAVEL

This role follows a hybrid model, requiring in‑office presence at least one day per week.

An employer who violates this law shall be subject to criminal penalties and civil liability.

#