Cybersecurity & Technology Audit Leader

OpenAI•San Francisco, CA

2d•$342,000 - $380,000•Hybrid

About The Position

The OpenAI Audit Team is building the future of internal audit from the ground up, leveraging AI, automation, and data analytics to identify and assess emerging risks across the business. As the Cybersecurity & Technology Audit Leader, you will play a pivotal role in shaping the strategy, methodology, technology, and culture of this new audit function. You will lead complex audits and advisory reviews focusing on cybersecurity, technology, data, and AI-related risks, providing guidance to leaders on strengthening governance, resilience, and risk management. This is a hands-on role for an experienced professional with deep technical expertise and strong business judgment, capable of bridging executive-level discussions with detailed technical analysis. You will have significant influence over the function's development, particularly in applying AI, automation, and analytics to audit processes. This is an opportunity to build a state-of-the-art capability rather than adapt a traditional model. The role is based in San Francisco, CA, with a hybrid work model (3 days in office) and relocation assistance available.

Requirements

12-15+ years of relevant experience in cybersecurity, technology audit, technology risk, security engineering, data risk, cloud security, or a related field.
Strong technical expertise across several areas, such as cloud platforms, identity and access management, application security, infrastructure, networks, vulnerability management, incident response, security operations, data platforms, or software development.
Strong knowledge of data architecture, provenance, lineage, quality, governance, access, and analytics, including the risks associated with using data in AI systems.
Knowledge of AI and machine-learning risks, along with experience using data analytics, scripting, automation, or AI-assisted techniques—or a demonstrated ability to develop these capabilities quickly.
The ability to understand complex systems, ask incisive questions, evaluate incomplete information, and reach well-supported conclusions with sound judgment.
The confidence to challenge constructively and a business-enabling mindset that balances innovation, speed, business impact, and risk.
Strong communication and relationship-building skills, including the ability to explain complex technical issues to executives and work effectively with technology leaders, engineers, risk professionals, and senior management.
Comfort operating in a fast-paced, evolving environment, with the initiative, curiosity, and adaptability to help build a new team and capability.
A bachelor’s degree in cybersecurity, computer science, information systems, engineering, data science, accounting, or a related discipline—or equivalent practical experience.

Nice To Haves

Relevant certifications, such as CISSP, CISA, CISM, CRISC, CCSP, cloud-provider certifications, or data and AI credentials are valued but not required.

Responsibilities

Build and execute a risk-based audit and advisory strategy across cybersecurity, infrastructure, systems architecture, cloud environments, data, software development, change management, operational resilience, and AI.
Drive strong governance and oversight of critical technology programs and emerging AI risks, including model governance, data provenance and quality, privacy, security, responsible AI, third-party dependencies, monitoring, and human oversight.
Assess complex technical environments and control effectiveness across areas—such as architecture, access models, system logs, code repositories, cloud controls, vulnerability data, and security monitoring—with a focus on distinguishing material risks from lower-value compliance issues.
Translate complex technical findings into clear business implications and practical recommendations that enable innovation while supporting effective risk management.
Build advanced audit capabilities using data analytics, automation, and AI to improve risk assessment, audit scoping, testing, continuous monitoring, and reporting, including identifying anomalies, control weaknesses, and emerging risks.
Build trusted relationships across the organization and support clear, effective reporting to executive management, regulators, and the Board.
Monitor developments in technology, threat activity, regulation, and industry practices to keep the audit approach current and forward-looking.
Coach colleagues, share technical expertise, and contribute to a culture of high standards, sound judgment, curiosity, ownership, and continuous learning.