Senior Internal IT Auditor

Klaviyo•Boston, MA

About The Position

Klaviyo’s Internal Audit (IA) function partners with operational leaders to monitor and improve internal controls and processes and drive operating efficiencies. The team is building an AI-first audit function by using AI and automation across the audit lifecycle. The Senior Internal IT Auditor will be a key member of Internal Audit, focusing primarily on IT SOX controls—including IT General Controls, IT application controls, and key reports—across homegrown and third-party systems. The role also offers opportunities to contribute to broader technology audits over time. The position reports to the VP of Internal Audit & Compliance, works closely with the Manager, IT SOX, and collaborates with stakeholders across IT, Security, Business Intelligence, Finance, Accounting, Legal, People Operations, Engineering, and Global Technology Solutions. There are no supervisory responsibilities. The role includes advising control owners while preserving Internal Audit’s independence, performing walkthroughs and control testing, documenting and tracking findings and remediation, coordinating with internal and external partners, and supporting the SOX program. The auditor will also use AI tools across audit work, create repeatable AI workflows, help establish validation practices, and assess AI-related risks in the financial reporting environment.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Accounting, Business, or another relevant field.
At least 5 years of IT audit experience in public accounting and/or industry, including IT SOX controls testing; experience in a technology or SaaS environment is ideal.
Strong understanding of SOX 404, PCAOB Auditing Standards, COSO 2013, COBIT, US GAAP, Internal Audit Standards, and audit processes and methodologies.
Strong understanding of scoping, designing, and testing IT-related controls for homegrown and off-the-shelf applications and cloud environments, including ITGCs, IT application controls, interfaces, key reports, segregation of duties, and SOC 1 reviews.
Previous experience auditing ITGCs related to CI/CD pipelines.
Experience planning, scoping, testing, and reporting within a full-year SOX program.
Experience leading the planning, scoping, execution, and reporting of IT, operational, or financial audits.
Data analytics skills and experience with SQL, Python, Tableau, or other data analytics or visualization tools.
Hands-on experience using AI tools in audit work, with concrete examples of how AI improved speed or quality and understanding of limitations such as accuracy, confidentiality, and over-reliance.
Experience collaborating with internal teams or co-sourced consulting resources.
Excellent written and verbal communication skills, including the ability to influence and explain technical concepts clearly to stakeholders.
Strong analytical and problem-solving skills, attention to detail, and an investigative mindset focused on root causes.
Self-starter who demonstrates initiative, curiosity to learn—including about AI and emerging technologies—and high energy.
Strong organizational skills, ability to prioritize workload, and ability to clearly communicate status.
Comfort working in a fast-paced, high-growth environment.
Professional audit-relevant certification; CISA is preferred.

Nice To Haves

Experience using SOX GRC tools such as Optro (formerly AuditBoard).
Experience with ERP systems such as NetSuite.
Working knowledge of AI governance frameworks such as NIST AI RMF or ISO/IEC 42001.
AI audit credentials such as ISACA AAIA.
CPA, CIA, or CISSP certification.
Experience in a technology or SaaS environment.

Responsibilities

Collaborate with the Internal Audit team to strengthen the internal control environment and continuously improve the SOX program.
Advise system control owners on internal control design while maintaining Internal Audit’s independence from implementing or operating controls; maintain the ITGC risk and control matrix in Optro.
Perform end-to-end system walkthroughs to identify SDLC controls, address risks, and evaluate ITGCs across homegrown applications and third-party SaaS, including code deployment and production access.
Prepare audit documentation request lists, coordinate with control owners, and track request status.
Test control design and operating effectiveness, including building test plans and audit workpapers in Optro.
Assess and track audit findings and gaps, including control weaknesses, root causes, and severity; coordinate remediation with control owners through Optro.
Prepare ITGC control training materials when needed.
Review IT-related policies and provide recommendations to policy owners as needed.
Support internal stakeholders addressing control deficiencies or making significant process changes.
Develop and maintain working relationships with process owners and stakeholders to increase awareness of risk, controls, and Internal Audit’s role.
Coordinate with co-sourced third-party providers, external auditors, and internal business partners to support engagement, alignment, and timely execution of audit work and the SOX program.
Develop and communicate status reports for ITGC-related projects and internal audits.
Perform IT application control testing over in-scope systems, including system interfaces and integrations.
Review SOC 1 reports, complementary user entity controls, and bridge letters for in-scope vendors.
Test key reports used in key controls, including information produced by the entity (IPE).
Evaluate the design and implementation of segregation of duties controls.
Evaluate IT controls designed to prevent or detect fraud, including management override of controls.
Assist with internal audit projects, including technology audits such as cloud security, data governance, and AI governance; document planning, scoping, audit programs, and request lists; track and communicate observations and management action plans; and participate in or lead walkthroughs.
Use AI tools across the audit lifecycle, including evidence review, walkthrough documentation, testing, and drafting observations, with human review and documented validation of outputs.
Build and maintain reusable prompts, workflows, and automations, and identify opportunities to improve audit-project efficiency.
Help define how Internal Audit validates AI-assisted work so the external auditor can rely on it.
Assess risks of AI tools and agents in the financial reporting environment, including access, data handling, and change management.
Perform other related duties as assigned.