Director, IT Audit Program Manager

Fidelity Investments•Westlake, TX

About The Position

Oversees key risks, threats, controls, and other critical technology risk management functions supporting FFIO, while supporting the launch of innovative products and offerings. Provides independent and objective audit and advisory services to help FFIO manage risk, improve customer service, and enhance business performance. Performs complex technology and business-integrated audits, develops risk and control hypotheses, contributes to the integrated audit plan, collaborates with application teams, and uses audit automation tools to evaluate business operations and systems. The role defines and manages program scope, objectives, and deliverables in alignment with organizational goals; leads technology risk assessments and issue mitigation and tracking; and analyzes workflow technology and end-to-end processes to identify embedded risks and controls. It helps the business establish control programs that mitigate risk and meet corporate standards, and partners with business and technology leaders to support organizational goals within the business’s risk tolerance. The role also applies strategic data analytics to identify control deficiencies, drafts audit reports describing issues, implications, and management action plans, and builds strong working relationships with audit teams and clients. The position requires a qualifying bachelor’s degree and six years of relevant experience, or a qualifying master’s degree and four years of relevant experience, in IT audit, information security assessments, and critical technology risk management for financial services applications and IT infrastructure spanning vendor, on-premises, and cloud environments. Fidelity notes that its onsite expectations are transitioning through a phased rollout across regions and roles; requirements vary and may evolve. Fidelity will not provide immigration sponsorship for this position.

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Technology, Information Systems, Information Management, Technology Management, or a closely related field (or foreign education equivalent), and six years of experience as a Director, IT Audit Program Manager or in a closely related occupation performing IT audit, information security assessments, and critical technology risk management for financial services applications and vendor, on-premises, and cloud IT infrastructure; alternatively, a relevant master’s degree and four years of such experience.
Demonstrated expertise triaging and guiding implementation of controls for existing and emerging technology risks in complex financial management and operations systems, using Power BI, Tableau, and Microsoft Office Suite (PowerPoint, Word, and Copilot).
Demonstrated expertise auditing internal controls and examining regulatory, financial, and technology risk using Python scripts, Microsoft Excel functions, and Macros across enterprise technology, risk and compliance functions, and finance, human resources, real estate, legal, diversified strategic investments, charitable, and emerging business incubator initiatives.
Demonstrated expertise performing IT risk analysis and security assessments of corporate-wide IT infrastructure; evaluating cloud and system development using cybersecurity principles and NIST CSF; and identifying technical control weaknesses, system vulnerabilities, and insecure configurations using AWS, Docker, API, Oracle DB, and Microsoft SQL Server.
Demonstrated expertise verifying Secure Software Development Lifecycle processes using DevOps and vulnerability scanning platforms including GitHub, Jenkins, Artifactory, and Qualys, and identifying security gaps in privileged account administration and secrets management using AWS Secrets Manager, Hashicorp, CyberArk, Active Directory, SAML, and oAuth.

Responsibilities

Define, manage, and implement program scope, objectives, and deliverables in alignment with organizational goals.
Lead technology risk assessments and issue mitigation and tracking.
Understand workflow technology and end-to-end related processes, identifying embedded risks and controls.
Help the business build control programs that mitigate risk and meet corporate standards.
Partner with business and technology leaders to support business goals while staying within risk tolerance.
Apply strategic data analytics concepts, principles, and techniques to identify control deficiencies efficiently and effectively.
Draft audit reports describing identified issues, their business or enterprise implications, and management action plans.
Build deep working relationships with audit teams and clients.
Perform complex technology and business-integrated audits, develop risk and control hypotheses, contribute to the integrated audit plan, collaborate with application teams, and use audit automation tools to evaluate business operations and systems.
Triage and guide implementation of controls for existing and emerging technology risks in complex financial management and operations systems.
Audit internal controls and examine regulatory, financial, and technology risks across enterprise technology, risk and compliance functions, and a range of business initiatives.
Perform IT risk analysis and security assessments of corporate-wide IT infrastructure; assess cloud and system development using cybersecurity principles and techniques; and identify technical control weaknesses, vulnerabilities, and insecure configurations.
Verify the security and efficiency of Secure Software Development Lifecycle processes and identify gaps in privileged account administration, secrets management, and service identification.