Internal IT Auditor, Senior

Blue Shield of California•Oakland, CA

8d•Hybrid

About The Position

The Senior Internal IT Auditor leads and executes audit engagements across technology and cybersecurity, serving as a subject matter resource and ensuring high-quality audit delivery. The role includes leading transactional quality review audits, supporting risk assessments and audit planning for data and AI governance, and evaluating technology, software, data, and AI-related controls and risks. The auditor works independently under limited supervision, owns projects or processes within the annual audit program, communicates findings to audiences at different levels, and develops productive relationships with clients and staff. The position also helps educate audit teams about data and AI risks and controls and keeps current with related trends, technologies, and regulations. This role follows a hybrid workplace model. Most teams work in the office two days each week; employees living more than 50 miles from an office location will determine in-office time with their manager based on business need.

Requirements

Bachelor’s degree, or a high school diploma/GED and four years of additional relevant experience in lieu of a degree.
At least five years of prior relevant experience.
Working knowledge of AI tools, models, and platforms, including generative AI and machine-learning systems, and their associated risks, controls, and governance considerations.
Strong analytical and problem-solving skills.
Advanced knowledge of auditing, typically obtained through advanced education combined with experience.
Familiarity with frameworks such as COBIT, NIST, ISO, or HIPAA.
Experience in software development, including SDLC methodologies such as Agile, DevOps, and CI/CD, and modern engineering practices.
Familiarity with secure coding practices, code management tools such as Git-based repositories, and application security controls.
Understanding of data governance and data protection principles, including privacy, confidentiality, regulatory compliance, and intellectual property management.
Experience in managing, governing, and controlling the use of artificial intelligence.
Basic competence and knowledge, with support from others, in financial accounting and finance concepts, managerial accounting, regulatory, legal and economics, quality frameworks, ethics and fraud, information technology, governance, risk and controls, and organizational theory and behavior.

Nice To Haves

Practical knowledge of project management.
Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), Certified Information Systems Security Professional (CISSP), Certified Internal Auditor (CIA), and/or Certified Secure Software Lifecycle Professional (CSSLP) certification.
Experience auditing or implementing AI governance frameworks, such as the NIST AI Risk Management Framework or internal AI governance programs.
Experience with AI/ML model risk management, including validation, bias detection, explainability, and monitoring.
Familiarity with secure AI development practices and emerging AI risk domains such as prompt injection, data poisoning, and model leakage.
Experience in regulated environments such as healthcare.

Responsibilities

Perform and lead transactional quality review audits with limited or no supervision.
Apply expert knowledge of transactional quality assurance audit principles and methodology as a subject matter expert in multiple functional areas.
Support risk assessments and develop audit plans for data and AI governance areas.
Review controls over AI-enabled business processes, including data sourcing, model outputs, decisioning logic, and human oversight mechanisms.
Lead corrective and preventive action planning related to transactional audits.
Assess the design and operating effectiveness of controls for protecting intellectual property, including source code repositories, model artifacts, proprietary algorithms, and data assets.
Audit DevSecOps pipelines, including CI/CD tooling, automated testing, code promotion, and segregation of duties across development environments.
Evaluate risks related to open-source software, third-party libraries, and external AI services, including licensing compliance, security vulnerabilities, and data leakage.
Analyze risks in data used for software and AI development, including governance, quality, lineage, privacy, and regulatory compliance considerations such as HIPAA.
Assess AI governance frameworks, including intake, approval, ethical review, monitoring, incident management, and model retirement processes.
Research issues and communicate findings effectively to executives, managers, and line staff, tailoring messages to the audience.
Develop and maintain productive client and staff relationships through individual contacts and group meetings.
Work independently under limited supervision and take responsibility for entire projects or processes within the BSC annual audit program.
Communicate with internal and external parties and educate others on complex disciplines; may communicate with external parties such as customers and vendors.
Work to influence operational-level policies, practices, and procedures within and outside BSC.
Stay updated on data and AI trends, technologies, and regulations; apply insights to audit engagements and support audit-team education on data and AI risks and controls.