Assurance Manager, Third Party Attestation

BDO USA

20h•$110,000 - $160,000

About The Position

The Assurance Manager, Third Party Attestation leads audit professionals through the planning, fieldwork, and wrap-up phases of third-party attestation engagements. Reports and frameworks include SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, WebTrust for CAs, HITRUST, SSPA, ISO, MRC, and CSA STAR. The role ensures compliance with applicable standards and regulations while documenting, validating, testing, and assessing control systems, including internal controls. The team focuses on third-party attestation and the broader technology risk umbrella rather than general ITGC or IT audit work. The manager oversees control-environment assessments and engagement quality, applies professional auditing standards and BDO methodology, manages client relationships, supervises and develops team members, and researches complex technical matters. The role serves as the primary client contact, reviews workpapers and reports, manages project delivery and deadlines, and communicates findings and recommendations to clients and leadership. Travel may be required. The position requires a bachelor's degree in a relevant field, more than five years of prior IT, internal, or external audit experience, supervisory experience, and at least one of the listed professional certifications. A master's degree and experience with specified attestation and advisory engagements, software, and technologies are preferred. Salary ranges vary by geography: California $120,000–$160,000; Colorado $110,000–$150,000; Illinois $110,000–$130,000; Massachusetts $110,000–$150,000; and NYC/Long Island/Westchester $110,000–$150,000.

Requirements

Bachelor’s degree in Accounting, Computer Science, Management Information Systems, Business Administration, Managerial Marketing and Entrepreneurship, Finance, or Economics.
More than five years of prior experience in IT, internal audit, or external audit.
Supervisory experience.
At least one of the following certifications: CPA, CISA, CISSP, ISO 27001 Lead Auditor, HITRUST CCSFP, CIA, CISM, CEH, CRISC, or CGEIT.
Excellent understanding of planning and coordinating technology-focused audits and assessments.
Strong knowledge of internal controls and professional standards and regulations, including SOC, ISO, WebTrust, HITRUST, and Sarbanes-Oxley.
Strong analytical and diagnostic skills and ability to break down complex issues and implement appropriate resolutions.
Ability to multitask independently and in a group, and work in a demanding, deadline-driven environment with attention to detail and accuracy.
Strong project management skills and ability to manage multiple projects simultaneously.
Ability to manage a team of professionals, delegate assignments, encourage teamwork, and support personnel development.
Ability to build and maintain strong relationships with client personnel and serve as the primary contact on assigned engagements.
Strong verbal and written communication skills, with the ability to adapt messaging to professionals at all levels within the client organization and firm.
Ability to travel as necessary.

Nice To Haves

Master’s degree in Accounting with a minor or dual major in Information Systems, or another relevant advanced degree.
Experience performing SOC, WebTrust, HITRUST, SOX, ISO 27001, and security/privacy advisory engagements.
Proficiency with Microsoft Office Suite, specifically Word, Excel, and PowerPoint.
Experience with applications such as ERP systems, operating systems such as UNIX and Windows, and databases such as Oracle and SQL.
Exposure to cloud platforms, SaaS applications, security and engineering tools, and other industry software.
Knowledge of data analytics and emerging technologies.

Responsibilities

Lead and oversee planning, fieldwork, and wrap-up for third-party attestation examinations.
Apply relevant governing principles, policies, laws, rules, regulations, and professional standards to engagements.
Assess control environments, identify and prioritize risks, design test plans, evaluate deficiencies, and assess overall controls.
Oversee documentation and validation of the operating effectiveness of clients’ internal control systems.
Oversee documentation of business and IT processes and controls, and testing of key service-organization controls.
Review client attestation reports and supporting workpapers for accuracy, completeness, and appropriate testing.
Apply auditing theory and professional skepticism; document workpapers and reports in accordance with BDO policy and standards.
Identify testing that may need to be reduced or expanded and notify the engagement partner as appropriate.
Serve as the primary client contact, maintain client relationships, and resolve complex issues with clients and leadership.
Supervise engagement teams, review workpapers and conclusions, delegate work, and provide on-the-job training and performance feedback.
Communicate suggestions for improving client internal controls and procedures to management or audit committees.
Draft attestation reports and communicate their contents to clients.
Integrate technology appropriately into the examination process and apply new pronouncements to client situations.
Ensure BDO documentation, assurance manual, methodology, archiving, and engagement requirements are followed.
Prepare or review timely and complete communications to management and audit committees; recommend outcomes to critical issues.
Initiate and prepare client acceptance and retention procedures where appropriate.
Research complex topics using authoritative sources, form conclusions, prepare supporting memos, and present issues to technical reviewers.
Schedule and manage Associates’ and Senior Associates’ workload, review their work, provide feedback, and act as a Career Advisor.
Perform other duties as required.