Internal IT Auditor, Senior

Blue Shield of California•Oakland, CA

9d•$102,424 - $153,636•Hybrid

About The Position

The Senior Internal IT Auditor leads and executes audit engagements across technology and cybersecurity domains, serving as a subject matter resource and ensuring high-quality audit delivery. The role supports risk assessments and audit planning for data and AI governance, evaluates controls across AI-enabled processes and software development, and assesses risks involving intellectual property, data protection, AI governance, and third-party technology. The auditor works independently with limited supervision, manages projects or processes within the annual audit program, communicates findings to varied audiences, and helps educate audit teams about data and AI risks and controls. The position follows a hybrid workplace model that balances in-person collaboration with flexibility. For most teams, employees work in the office two days each week. Employees who live more than 50 miles from an office location coordinate with their manager to determine in-office time based on business needs.

Requirements

Bachelor’s degree, or a High School Diploma/GED and four years of additional relevant experience in lieu of a degree.
Minimum of five years of prior relevant experience.
Basic competence and knowledge, with support from others, in financial accounting and finance concepts, managerial accounting, regulatory, legal and economics, quality framework, ethics and fraud, information technology, governance, risk and controls, and organizational theory and behavior.
Working knowledge of AI tools, models, and platforms, including generative AI and machine-learning systems, and their associated risks, controls, and governance considerations.
Strong analytical and problem-solving skills.
Advanced auditing knowledge, typically obtained through advanced education combined with experience; practical project management knowledge may be expected.
Familiarity with frameworks such as COBIT, NIST, ISO, or HIPAA.
Experience in software development, including SDLC methodologies such as Agile, DevOps, and CI/CD, and modern engineering practices.
Familiarity with secure coding practices, code management tools such as Git-based repositories, and application security controls.
Understanding of data governance and data protection principles, including privacy, confidentiality, regulatory compliance, and intellectual property management.
Experience auditing or implementing AI governance frameworks, such as NIST AI RMF or internal AI governance programs.
Experience with AI/ML model risk management, including validation, bias detection, explainability, and monitoring.
Familiarity with secure AI development practices and emerging AI risk domains, such as prompt injection, data poisoning, and model leakage.
Experience in the management, governance, and control of artificial intelligence use.
Experience in regulated environments, such as healthcare.

Nice To Haves

Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), Certified Information Systems Security Professional (CISSP), Certified Internal Auditor (CIA), and/or Certified Secure Software Lifecycle Professional (CSSLP).

Responsibilities

Perform and lead transactional quality review audits with limited or no supervision.
Apply expert knowledge of transactional quality assurance audit principles and methodology as a subject matter expert in multiple functional areas.
Support risk assessments and development of audit plans for data and AI governance areas.
Review controls over AI-enabled business processes, including data sourcing, model outputs, decisioning logic, and human oversight mechanisms.
Lead corrective and preventive action planning related to transactional audits.
Assess the design and operating effectiveness of controls for intellectual property protection, including source code repositories, model artifacts, proprietary algorithms, and data assets.
Audit DevSecOps pipelines, including CI/CD tooling, automated testing, code promotion, and segregation of duties across development environments.
Evaluate risks associated with open-source software, third-party libraries, and external AI services, including licensing compliance, security vulnerabilities, and data leakage.
Analyze risks associated with data used in software and AI development, including governance, quality, lineage, privacy, and regulatory compliance.
Assess AI governance frameworks, including intake, approval, ethical review, monitoring, incident management, and model retirement processes.
Research issues and effectively communicate findings to executives, managers, line staff, and other groups, tailoring messages to the audience.
Develop and maintain productive relationships with clients and staff through individual contacts and group meetings.
Work toward operational targets that directly affect BSC departmental results.
Work independently under limited supervision and take responsibility for entire projects or processes within the BSC annual audit program.
Communicate with internal and external parties and educate others on complex disciplines; this may include customers and vendors.
Influence parties within and outside BSC at an operational level regarding policies, practices, and procedures.
Stay current on data and AI trends, technologies, and regulations; apply insights to audit engagements and support audit-team education on data and AI risks and controls.