Senior Internal IT Auditor

Klaviyo•San Francisco, CA

About The Position

Klaviyo’s Internal Audit function partners consultatively with operational leaders to monitor and improve internal controls and processes and drive operating efficiencies. The Senior Internal IT Auditor will be a key member of the function, focusing primarily on IT SOX controls—including IT general controls, application controls, and key reports—across homegrown and third-party systems, with opportunities to support broader technology audits as the program grows. The role reports to the VP of Internal Audit & Compliance and works closely with the Manager, IT SOX, and stakeholders across IT, Security, Business Intelligence, Finance, Accounting, Legal, People Operations, Engineering, and Global Technology Solutions. The position supports and strengthens the company’s SOX program and contributes to an AI-first audit function by using AI and automation across the audit lifecycle. AI-assisted work requires human review and documented validation. The role also helps develop repeatable AI prompts, workflows, and automations and assess risks posed by AI tools and agents in the financial reporting environment. There are no supervisory responsibilities. Occasional travel to office hubs is required. The physical demands include prolonged periods of sitting at a desk and working on a computer.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Accounting, Business, or another relevant field.
At least 5 years of IT audit experience in public accounting and/or industry, including IT SOX controls testing; experience in a technology or SaaS environment is ideal.
Strong understanding of SOX 404, PCAOB Auditing Standards, COSO 2013, COBIT, US GAAP, Internal Audit Standards, and auditing processes and methodologies.
Strong understanding of scoping, designing, and testing IT controls for homegrown and off-the-shelf applications and cloud environments such as AWS, including ITGCs, application controls, interfaces, key reports, segregation of duties, and SOC 1 reviews.
Previous experience auditing ITGCs related to CI/CD pipelines.
Experience planning, scoping, testing, and reporting within a full-year SOX program.
Experience leading planning, scoping, execution, and reporting for IT, operational, or financial audits.
Data analytics skills and experience with SQL, Python, Tableau, or other data analytics or visualization tools.
Hands-on experience using AI tools in audit work, with concrete examples of how AI improved speed or quality and an understanding of its limits, including accuracy, confidentiality, and over-reliance.
Experience collaborating with internal or co-sourced consulting teams.
Excellent written and verbal communication skills, including the ability to influence and explain technical concepts clearly to stakeholders.
Strong analytical and problem-solving skills, attention to detail, and an investigative approach to identifying root causes.
Self-starter who demonstrates initiative, curiosity—including about AI and emerging technologies—and high energy.
Strong organizational skills, ability to prioritize workload, and ability to communicate status clearly.
Comfort working in a fast-paced, high-growth environment.

Nice To Haves

Experience using SOX GRC tools such as Optro (formerly AuditBoard) and ERP systems such as NetSuite is strongly preferred.
CISA certification is preferred; CPA, CIA, or CISSP is a plus.
Working knowledge of AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, or AI audit credentials such as ISACA AAIA.

Responsibilities

Collaborate with the Internal Audit team and the company to strengthen the internal control environment and continuously improve the SOX program.
Advise system control owners on control design while maintaining Internal Audit’s independence from implementing or operating controls; maintain the ITGC risk and control matrix in Optro.
Conduct end-to-end system walkthroughs to identify SDLC controls, address risks, and evaluate ITGCs across homegrown applications and third-party SaaS, including code deployment and production access.
Prepare audit documentation request lists, coordinate with control owners, and track request status.
Test the design and operating effectiveness of controls, including building test plans and audit workpapers in Optro.
Assess and track audit findings and gaps, including control weaknesses, root cause, and severity; coordinate deficiency remediation with control owners through Optro.
Prepare ITGC control training materials when needed and review IT-related policies or recommend changes to policy owners as needed.
Guide and support internal stakeholders addressing control deficiencies or significant process changes.
Build and maintain effective relationships with process owners and stakeholders to increase awareness of risk, controls, and Internal Audit’s role.
Coordinate with co-sourced providers, external auditors, and internal business partners to align and execute audit work and the SOX program on schedule.
Develop and communicate status reporting for ITGC-related projects and internal audits.
Test IT application controls over in-scope systems, including interfaces and integrations.
Review SOC 1 reports, complementary user entity controls, and bridge letters for in-scope vendors.
Test key reports used in key controls, including information produced by the entity (IPE).
Evaluate the design and implementation of segregation of duties controls.
Evaluate IT controls designed to prevent or detect fraud, including management override of controls.
Support internal audit projects, including technology audits such as cloud security, data governance, and AI governance; document planning, scoping, audit programs, and request lists, track and communicate observations and management action plans, and participate in or lead walkthroughs.
Use AI tools across the audit lifecycle, including evidence review, walkthrough documentation, testing, and drafting observations, with human review and documented validation of outputs.
Build and maintain reusable prompts, workflows, and automations, identify opportunities to improve audit efficiency, and help define validation practices for AI-assisted work that can support external auditor reliance.
Assess risks of AI tools and agents in the financial reporting environment, including access, data handling, and change management.
Perform other related duties as assigned.