Internal IT Auditor, Senior

Blue Shield of California•Oakland, CA

23h

About The Position

The Senior Internal IT Auditor leads and executes audit engagements, serving as a subject matter resource and ensuring high-quality audit delivery across technology and cybersecurity domains. In this role, you will be responsible for performing and leading transactional quality review audits with limited or no supervision. You will have expert knowledge of transactional quality assurance audit principles and methodology and be considered a subject matter expert in multiple functional areas. You will support risk assessments and development of audit plans for data and AI governance areas, review controls over AI-enabled business processes, including data sourcing, model outputs, decisioning logic, and human oversight mechanisms, and lead corrective/preventive action planning related to transactional audits. You will assess the design and operating effectiveness of controls related to intellectual property (IP) protection, including source code repositories, model artifacts, proprietary algorithms, and data assets. You will perform audits of DevSecOps pipelines, including CI/CD tooling, automated testing, code promotion, and segregation of duties across development environments. You will evaluate risks related to the use of open-source software, third-party libraries, and external AI services, including licensing compliance, security vulnerabilities, and data leakage. You will analyze risks associated with data used in software and AI development, including data governance, quality, lineage, privacy, and regulatory compliance (e.g., HIPAA data considerations). You will assess AI governance frameworks, including intake, approval, ethical review, monitoring, incident management, and model retirement processes. You will research issues and share the findings of that work with varying groups effectively (executives, managers, line staff, etc.). You will develop and maintain productive client and staff relationships through individual contacts and group meetings. You will be proficient in either operational, financial or IT auditing, but not yet an expert, and your work will still need oversight to be released and reviewed by Management. You will work to achieve operational targets with direct impact on BSC departmental results and be responsible for entire projects or processes within the BSC annual audit program. You will communicate with parties within and outside of BSC with the ability to educate others on complex disciplines.

Requirements

Requires a bachelor’s degree or equivalent experience
Requires a minimum of 5 years of prior related experience
Basic competence and knowledge with support from others of: Financial Accounting and Finance Concepts, Managerial Accounting, Regulatory, Legal and Economics, Quality Framework, Ethics and Fraud, Information Technology, Governance, Risk and Controls, Organizational Theory and Behavior
Working knowledge of AI tools, models, and platforms (e.g., generative AI, ML systems), including associated risks, controls, and governance consideration
Strong analytical and problem-solving skills
Advanced knowledge of auditing typically obtained through advanced education combined with experience
May have practical knowledge of project management

Nice To Haves

Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), Certified Information Systems Security Professional (CISSP), Certified Internal Auditor (CIA) and/or Certified Secure Software Lifecycle Professional (CSSLP) highly desired

Responsibilities

Performing and leading transactional quality review audits with limited or no supervision
Supporting risk assessments and development of audit plans for data and AI governance areas
Reviewing controls over AI-enabled business processes, including data sourcing, model outputs, decisioning logic, and human oversight mechanisms
Leading corrective/preventive action planning related to transactional audits
Assessing design and operating effectiveness of controls related to intellectual property (IP) protection, including source code repositories, model artifacts, proprietary algorithms, and data assets
Performing audits of DevSecOps pipelines, including CI/CD tooling, automated testing, code promotion, and segregation of duties across development environments
Evaluating risks related to use of open-source software, third-party libraries, and external AI services, including licensing compliance, security vulnerabilities, and data leakage
Analyzing risks associated with data used in software and AI development, including data governance, quality, lineage, privacy, and regulatory compliance (e.g., HIPAA data considerations)
Assessing AI governance frameworks, including intake, approval, ethical review, monitoring, incident management, and model retirement processes
Researching issues and sharing the findings of that work with varying groups effectively (executives, managers, line staff, etc.)
Developing and maintaining productive client and staff relationships through individual contacts and group meetings
Working to achieve operational targets with direct impact on BSC departmental results
Being responsible for entire projects or processes within BSC annual audit program
Communicating with parties within and outside of BSC with the ability to educate others on complex disciplines