Senior Auditor - IT Systems and Controls

Lambda•San Jose, CA

1d•$184,000 - $245,000•Hybrid

About The Position

Lambda is seeking an experienced Senior Auditor - IT Systems and Controls to join its Internal Audit function. This role reports to the Internal Audit Lead - IT Systems and Controls. The Senior Auditor will independently execute IT SOX testing for assigned systems, review the work of co-sourced or junior team members, and act as a liaison with engineering, IT, and security teams for both Lambda's homegrown platform and third-party SaaS applications. The position requires presence in the San Jose or San Francisco office 4 days per week, with Tuesdays designated as the work-from-home day.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Accounting, or related field.
CISA strongly preferred; CISSP, CPA, or CIA a plus.
8+ years of progressive experience in IT audit, IT risk, or IT SOX compliance, at a level equivalent to Manager at a Big Four accounting firm, or an internal audit professional with comparable scope and seniority in industry.
Big Four accounting firm or equivalent experience in Internal or External Audit or IT consulting practice, including experience reviewing and directing the work of junior staff.
Deep expertise in ITGCs, IT Automated Controls, key report testing, and their relevance to ICFR, internal audit methodology, and IIA standards.
Experience independently leading audits of both homegrown business systems and third-party SaaS applications.
Demonstrated experience in data governance, system implementation reviews, and cybersecurity risk assessments.
Experience working with audit management tools (e.g., AuditBoard, Archer, Workiva) to manage SOX and IT compliance programs.
Strong analytical and technical skills with the ability to independently evaluate IT and data risks across complex environments.
Excellent communication and interpersonal skills to effectively engage with, and influence, both technical and non-technical senior stakeholders.
Proven ability to review and quality-check the work of junior team members or co-sourced resources, even without formal direct reports.
Organized, detail-oriented, and able to manage multiple concurrent engagements in a dynamic, fast-growth environment with minimal oversight.

Nice To Haves

Experience with data analytics and automated testing tools (e.g., SQL, Python, ACL, Power BI) to enhance SOX testing efficiency and insights.
Exposure to emerging technologies such as cloud computing, cybersecurity, and RPA, and their control implications.
Prior experience working in a fast-growth or pre-IPO organization, building or scaling a SOX program ahead of public-company readiness.
Familiarity with cybersecurity frameworks (e.g., NIST, ISO 27001, COBIT) and their application to IT risk management.
Experience auditing engineering practices such as GitHub-based change management, CI/CD pipelines, or internally managed databases.
Prior involvement in system implementation or upgrade reviews for ERP, financial systems, or homegrown applications.
Experience presenting findings to senior leadership or an Audit Committee.

Responsibilities

Plan, execute, and document SOX testing for IT General Controls (ITGCs), IT Automated Controls, and Key Reports across assigned in-scope systems, exercising independent judgment on complex or ambiguous control questions.
Contribute to the annual IT SOX scoping and risk assessment process for assigned systems, in alignment with the overall ICFR and SOX program.
Conduct walkthroughs and design/effectiveness testing of IT controls across homegrown and third-party systems, engaging directly with control owners and engineering leads.
Review the testing work of co-sourced resources or junior team members for quality, completeness, and adherence to methodology.
Coordinate evidence collection and remediation efforts, holding process and system owners accountable to agreed timelines.
Identify control deficiencies, evaluate severity and root cause, and partner with engineering and IT management to design and validate effective remediation.
Maintain ICFR/SOX 404 documentation for assigned areas, including COSO framework mapping, process and control narratives/flowcharts, risk and controls matrices, and testing approach.
Apply professional skepticism to independently evaluate and conclude on control design and operating effectiveness.
Execute internal audit and advisory projects focused on IT, data governance, and emerging technology risk, with a primary focus on internal controls over financial reporting.
Advise technology and business stakeholders on IT risk management and control optimization for their assigned area.
Evaluate data integrity, system development practices, access management, and change management processes across homegrown and third-party systems.
Partner directly with engineering and IT teams to design practical, scalable controls that fit a fast-moving codebase and infrastructure.
Assess the severity and impact of control deficiencies, including evaluation of aggregation and compensating controls.
Work with engineering and IT process owners to develop, track, and validate remediation plans on time.
Recommend process improvements and efficiency opportunities while maintaining control effectiveness.
Serve as the day-to-day point of contact for IT, Engineering, and Security teams on IT SOX and assurance activities for assigned systems.
Support external auditors during IT SOX testing for assigned systems, providing evidence, walkthroughs, and context as needed.
Provide guidance to IT and business stakeholders, and informal coaching to co-sourced or junior team members, on IT control requirements and leading practices.
Prepare clear, well-organized workpapers and status updates on testing results and remediation progress for the Internal Audit Lead and Head of Internal Audit, including materials to support their Audit Committee reporting.
Translate technical IT control issues into business-relevant language for non-technical stakeholders.
Monitor industry and regulatory developments relevant to assigned systems, flagging emerging risks to the Internal Audit Lead.