Manager, IT Audit

Biogen•Cambridge, MA

1d•Hybrid

About The Position

The Manager, IT Audit at Biogen strengthens technology risk management, cybersecurity posture, and the control environment. The role partners with leaders across IT, Cyber, and the business to provide risk-based, practical insights that support informed decision-making and continuous improvement. The manager owns audit engagements from planning through closure and is accountable for quality, timeliness, and outcomes. As part of the Internal Audit team, the role leads complex cybersecurity, cloud, SaaS, third-party, and integrated IT audits. It also contributes to the department’s emerging technology agenda, including AI/GenAI risk coverage and data analytics automation, as well as departmental methodology, technology enablement, talent development, and Audit Committee reporting initiatives. The position provides broad business exposure and opportunities to develop technical audit judgment and grow within Internal Audit or the life sciences industry.

Requirements

At least 5 years of diversified internal or external IT audit, IT risk advisory, or cybersecurity audit experience.
Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, or a related field.
Strong knowledge of IT audit methodology, IT General Controls, and cybersecurity control frameworks.
Excellent communication and project management skills.
Willingness to travel up to 10% for domestic and international assignments.
Strong understanding of IT General Controls, cybersecurity fundamentals, and leading frameworks such as NIST, COBIT, ISO 27001, and OWASP.
Working knowledge of cloud, SaaS, and third-party technology risk.
Ability to navigate ambiguity, communicate technology and cyber risk clearly, engage with senior stakeholders, manage difficult conversations, and challenge constructively.

Nice To Haves

Big 4 experience.
Life Sciences industry experience or relevant technology risk experience outside audit.
Master’s degree in a related field.
Experience with AWS, Azure, or GCP cloud environments.
Experience with cybersecurity tools such as CrowdStrike, Zscaler, Palo Alto, Microsoft Defender, or Splunk.
Experience with AI/GenAI risk frameworks such as NIST AI RMF.
Experience with audit management platforms such as AuditBoard.
Experience with generative AI applications such as Microsoft Copilot.
Experience with data analytics or visualization tools such as Alteryx, Python, Microsoft Power BI, or Tableau.
CISA, CISSP, or equivalent certification.

Responsibilities

Lead IT, cybersecurity, cloud, SaaS, third-party, and integrated audits from planning through reporting and follow-up, managing scope, execution quality, and results.
Use a risk-based approach to identify technology and cyber risks, evaluate control effectiveness, and adjust audit scope based on emerging issues and insights.
Present audit findings and practical remediation recommendations to senior IT, Cyber, and business leaders.
Develop concise, clear, decision-oriented audit reports.
Build trusted relationships with IT, Cyber, and business leaders while maintaining independence and objectivity.
Coach and review the work of audit team members, co-ops, and external providers, providing actionable feedback and supporting capability development.
Contribute to the annual risk assessment and audit plan, focusing on emerging technology risks including AI/GenAI, cloud, and third-party exposures.
Use data analytics and AI-enabled tools to enhance risk identification, audit coverage, and efficiency, and help advance audit automation.
Contribute to departmental strategic initiatives and continuous improvement, including methodology, technology enablement, talent development, and Audit Committee reporting; lead select workstreams as opportunities arise.
Drive continuous improvement in audit execution, tools, and ways of working within assigned engagements and portfolios.

Benefits

Short- and long-term incentives, including cash bonus and equity incentive opportunities.
Medical, dental, vision, and life insurance.
Fitness and wellness programs, including fitness reimbursement.
Short- and long-term disability insurance.
At least 15 days of paid vacation and end-of-year shutdown time off from December 26 through December 31.
Up to 12 company-paid holidays and 3 paid days off for Personal Significance.
80 hours of sick time per calendar year.
Paid maternity and parental leave.
401(k) program with company-matched contributions.
Employee stock purchase plan.
Tuition reimbursement of up to $10,000 per calendar year.
Employee Resource Groups participation.