IT Audit Manager, Corporate Technology & Cybersecurity - HYBRID

First American•Santa Ana, CA

7d•$129,300 - $172,300•Hybrid

About The Position

The IT Audit Manager leads complex, risk-based technology and cybersecurity audits from annual planning through reporting. The role serves as the senior audit contact for client leadership, directs audit strategy and scope, confirms audit work is complete and supportable, and presents results to senior management and examiners. The manager leads executive discussions with technology, security, risk, finance, and business leaders; sets audit objectives, risk assessments, scope, criteria, resources, and timing; and ensures audit coverage is complete and well-supported. The role oversees the Lead and audit team, owns engagement decisions and reporting, coordinates with assurance teams and external auditors, and develops auditors and audit methods. The position is described as hybrid.

Requirements

At least 8 years of relevant experience, including leading complex IT or cybersecurity audits and advising on technology risks and controls.
Experience leading operational cybersecurity or data-risk audits.
Demonstrated experience managing teams and engaging senior client leadership.
Extensive IT/cybersecurity audit leadership in one or more listed domains, with the ability to assess scope completeness and direct related work. Domains include threat intelligence or hunting; Security Operations or incident response; endpoint or network security; data security, protection, or privacy; insider risk or digital forensics; offensive security, penetration testing, or application security; vulnerability or patch management; identity and access management; cloud security or service management; PKI or certificate management; network or technology operations; IT asset management; change or release management; Secure SDLC; data management; IT/IS governance or strategy; business continuity or disaster recovery; and technology portfolio, project, or program management.
Hands-on security-configuration audit experience with firewalls, SIEM, cloud security, WAF, encryption, or certificates.
Primary leadership depth in at least one complementary area: IAM/PAM and identity architecture, including CyberArk and Active Directory; network security, including firewalls and segmentation; cloud security architecture and WAF; Security Operations, including monitoring and incident response; vulnerability management; or Data Protection, including DLP, encryption, key management, and data controls. Comparable tools are acceptable.
Familiarity with official security guidance for Microsoft Azure, AWS, and Google Cloud, including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance; able to apply relevant guidance to audit scope, architecture, control design, and operating effectiveness.
Advanced understanding of risk assessment, internal control design and operating effectiveness, audit evidence, sampling, issue development, and accepted internal audit standards.
Strong executive presence, negotiation, writing, presentation, and relationship-building skills, with sound judgment in sensitive or high-pressure discussions.

Nice To Haves

CISA or equivalent certification, such as CISM, CISSP, CRISC, or CIPP/US, is strongly preferred.
Banking IT audit experience and regulatory examination experience are preferred.
Relevant IT or cybersecurity coursework, professional training, or hands-on experience is valued.
Familiarity with AuditBoard, Power BI, ServiceNow, Jira, or SailPoint is helpful.

Responsibilities

Lead executive-level discussions with technology, security, risk, finance, and business leaders, including the CTO, CISO, CRO, and their direct reports.
Set audit objectives, risk assessments, scope, criteria, resources, and timing; evaluate coverage against the audit universe, enterprise architecture, regulations, prior findings, emerging technology, and dependencies.
Direct audits across technology and cybersecurity programs, applying technical audit judgment or involving qualified subject-matter expertise as needed.
Ensure audits assess security-asset configuration and operation, including baselines, rules and settings, privileged access, logging and monitoring, encryption, certificate lifecycle, changes, and exceptions.
Direct and challenge configuration-focused audit coverage across specialties such as identity and privileged access, network security and segmentation, cloud security architecture and WAF, Security Operations monitoring and response, vulnerability management, and data-protection controls.
Oversee the Lead and audit team; review plans, walkthroughs, sampling, procedures, evidence, workpapers, issue evaluations, and reporting for quality and support.
Own engagement decisions, issue severity and root cause, action plans, and reports; escalate promptly and resolve differences while preserving audit independence.
Present audit plans, status, results, and significant risks to Internal Audit leadership, executives, regulators, and examiners, and keep examination materials complete and supportable.
Coordinate with assurance teams and external auditors on reliance while protecting Internal Audit scope and conclusions.
Coach auditors, build technical capability, manage resources and deadlines across concurrent projects, and improve audit methods, continuous auditing, and analytics.