IT Audit Manager, Corporate Technology & Cybersecurity - HYBRID

First American•Santa Ana, CA

6d•Hybrid

About The Position

The IT Audit Manager leads complex, risk-based technology and cybersecurity audits from annual planning through reporting. The role serves as the senior audit contact for client leadership, directs audit strategy and scope, ensures work is complete and supportable, and presents results to senior management, regulators, and examiners. The manager oversees audit staff and concurrent project resources, owns engagement decisions and reporting, and helps improve audit methods, continuous auditing, and analytics. The position is hybrid.

Requirements

At least 8 years of relevant experience, including leading complex IT or cybersecurity audits and advising on technology risks and controls.
Experience leading operational cybersecurity or data-risk audits.
Demonstrated experience managing teams and engaging senior client leadership.
Extensive IT or cybersecurity audit leadership in one or more domains, including the listed areas of cybersecurity, technology operations, governance, continuity, and technology portfolio or program management.
Ability to assess scope completeness and direct related audit work.
Hands-on security-configuration audit experience with firewalls, SIEM, cloud security, WAF, encryption, or certificates.
Primary leadership depth in at least one complementary area: IAM/PAM and identity architecture (including CyberArk and Active Directory), network security (including firewalls and segmentation), or cloud security architecture and WAF; or Security Operations (including monitoring and incident response), vulnerability management, or Data Protection (including DLP, encryption, key management, and data controls). Experience with comparable tools is acceptable.
Familiarity with official security guidance for Microsoft Azure, AWS, and Google Cloud, including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance.
Ability to apply relevant security guidance when evaluating audit scope, architecture, control design, and operating effectiveness.
Advanced understanding of risk assessment, internal control design and operating effectiveness, audit evidence, sampling, issue development, and accepted internal audit standards.
Strong executive presence, negotiation, writing, presentation, and relationship-building skills, with sound judgment in sensitive or high-pressure discussions.

Nice To Haves

CISA or equivalent certification, such as CISM, CISSP, CRISC, or CIPP/US.
Banking IT audit and regulatory examination experience.
Relevant IT or cybersecurity coursework, professional training, or hands-on experience.
Familiarity with AuditBoard, Power BI, ServiceNow, Jira, or SailPoint.

Responsibilities

Lead executive-level discussions with technology, security, risk, finance, and business leaders, including the CTO, CISO, CRO, and their direct reports.
Set expectations, resolve disagreements constructively, and communicate significant risks and conclusions.
Set audit objectives, risk assessments, scope, criteria, resources, and timing.
Assess scope completeness against the audit universe, enterprise architecture, regulations, prior findings, emerging technology, and dependencies.
Direct audits across the technology and cybersecurity programs identified in the job profile, applying technical audit judgment or involving qualified subject-matter expertise as needed.
Ensure audit scopes assess security-asset configuration and operation, including baselines, rules and settings, privileged access, logging and monitoring, encryption, certificate lifecycle, changes, and exceptions.
Direct and challenge configuration-focused audit coverage in assigned specialties, such as identity and privileged access, network security and segmentation, cloud security architecture and WAF, Security Operations monitoring and response, vulnerability management, and data-protection controls.
Oversee the Lead and audit team, reviewing plans, walkthroughs, sampling, procedures, evidence, workpapers, issue evaluations, and reporting for quality and support.
Own engagement decisions, issue severity and root cause, action plans, and reports.
Escalate promptly and resolve differences while preserving audit independence.
Present plans, status, results, and significant risks to Internal Audit leadership, executives, regulators, and examiners, and keep examination materials complete and supportable.
Coordinate with assurance teams and external auditors on reliance while protecting Internal Audit scope and conclusions.
Coach auditors, build technical capability, manage concurrent-project resources and deadlines, and improve audit methods, continuous auditing, and analytics.