Manager, IT Audit
About The Position
The Manager, IT Audit at Biogen strengthens technology risk management, cybersecurity posture, and the control environment. The role partners with leaders across IT, Cyber, and the business to provide risk-based, practical insights that support informed decisions and continuous improvement. The manager owns audit engagements from planning through closure, ensuring quality, timeliness, and impact. The work includes leading complex cybersecurity, cloud, SaaS, third-party, and integrated IT audits, as well as contributing to the department’s emerging technology agenda, including AI/GenAI risk coverage and data analytics automation. The position is part of the Internal Audit team and also contributes to the annual risk assessment and audit plan, departmental strategic initiatives, methodology and technology enablement, talent development, and Audit Committee reporting. It offers broad business exposure and opportunities to develop technical audit judgment and lead selected workstreams.
Requirements
- At least 5 years of diversified internal and/or external IT audit, IT risk advisory, or cybersecurity audit experience.
- Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, or a related field.
- Strong knowledge of IT audit methodology, IT General Controls, and cybersecurity control frameworks.
- Excellent communication and project management skills.
- Willingness to travel up to 10% for domestic and international assignments.
- Strong understanding of IT General Controls, cybersecurity fundamentals, and leading frameworks including NIST, COBIT, ISO 27001, and OWASP.
- Working knowledge of cloud, SaaS, and third-party technology risk.
- Ability to navigate ambiguity, communicate technology and cyber risk effectively, engage senior stakeholders, manage difficult conversations, and challenge constructively.
Nice To Haves
- Big 4 experience.
- Life Sciences industry experience or relevant technology risk experience outside audit.
- Master’s degree in a related field.
- Experience with cloud environments such as AWS, Azure, or GCP; cybersecurity toolsets such as CrowdStrike, Zscaler, Palo Alto, Microsoft Defender, or Splunk; AI/GenAI risk frameworks such as NIST AI RMF; audit management platforms such as AuditBoard; Generative AI applications such as Microsoft Copilot; or data analytics and visualization tools such as Alteryx, Python, Microsoft Power BI, or Tableau.
- CISA, CISSP, or equivalent certification.
Responsibilities
- Lead end-to-end IT, cybersecurity, cloud, SaaS, third-party, and integrated audits from planning through reporting and follow-up, with accountability for scope, execution quality, and results.
- Use a risk-based approach to identify technology and cyber risks, evaluate control effectiveness, and adjust audit scope based on emerging issues and insights.
- Present audit findings and practical remediation recommendations to senior IT, Cyber, and business leaders.
- Develop concise, clear, decision-oriented audit reports.
- Build trusted relationships with IT, Cyber, and business leaders while maintaining independence and objectivity.
- Coach and review work performed by audit team members, co-ops, and external providers, providing actionable feedback and supporting capability development.
- Contribute to the annual risk assessment and audit plan, focusing on emerging technology risks such as AI/GenAI, cloud, and third-party exposures.
- Use data analytics and AI-enabled tools to enhance risk identification, audit coverage, and efficiency, and help advance audit automation.
- Contribute to departmental strategic initiatives and continuous improvement, including methodology, technology enablement, talent development, and Audit Committee reporting; lead selected workstreams as opportunities arise.
- Improve audit execution, tools, and ways of working within assigned engagements and portfolios.
Benefits
- Short- and long-term incentives, including cash bonus and equity incentive opportunities.
- Medical, dental, vision, and life insurance.
- Fitness and wellness programs, including fitness reimbursement.
- Short- and long-term disability insurance.
- At least 15 days of paid vacation and end-of-year shutdown time off from December 26 through December 31.
- Up to 12 company-paid holidays and 3 paid days off for Personal Significance.
- 80 hours of sick time per calendar year.
- Paid maternity and parental leave.
- 401(k) program with company-matched contributions.
- Employee stock purchase plan.
- Tuition reimbursement up to $10,000 per calendar year.
- Employee Resource Groups participation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Manager
