Senior IT Internal Auditor

Transat AT•Montreal, QC

1d•Hybrid

About The Position

Under the leadership of the Senior Director, Internal Audit and Enterprise Risk Management, the incumbent serves as a subject matter expert in IT audit and internal controls related to information technology. The role contributes to the assessment of the internal control over financial reporting (ICFR) framework in accordance with Regulation 52-109, while developing a risk-based IT operational internal audit coverage. Key responsibilities include planning and executing control testing, maintaining documentation of the IT control environment, coordinating activities with the external auditor, and identifying, assessing, and monitoring control deficiencies. The position also involves managing an IT audit program, including the identification, planning, and execution of IT internal audit engagements.

Requirements

Bachelor's degree in Information Systems, Computer Science, Accounting, Business Administration, Auditing, Risk Management, or a related field.
5 to 8 years of relevant experience in IT audit, internal controls, IT general controls (ITGCs), application controls, cybersecurity, or IT risk management.
Practical knowledge of IT general controls (ITGCs), application controls, report controls, and audit testing methodologies.
Ability to review and assess SOC 1, SOC 2, ISAE 3402, and other assurance reports issued by critical service providers.
Excellent communication, stakeholder management, collaboration, and project management skills, with the ability to manage multiple deliverables and work effectively with IT, Finance, Operations, and external audit stakeholders.
Oral and written fluency in French and English
A good knowledge of French is required for positions in Quebec. The incumbent will be required to communicate and collaborate frequently in English, both orally and in writing, with colleagues, customers, and other stakeholders in Quebec, the rest of Canada, and internationally.

Nice To Haves

CISA certification strongly preferred; CPA, CIA, CRMA, CRISC, CISSP, CISM, or an equivalent certification is considered an asset.
Knowledge of data analytics tools (e.g., Power BI); experience with SAP is considered an asset.

Responsibilities

Plan, execute, and document IT audit activities related to the 52-109 / ICFR program, including IT general controls (ITGCs), application controls, and report controls.
Serve as the primary point of contact for the external auditor on IT control matters, including coordinating requests, evidence collection, and follow-up activities.
Structure and maintain documentation of the IT control environment, including control inventories, systems, applications, interfaces, critical reports, and control owners.
Review SOC 1, SOC 2, ISAE 3402, and other assurance reports from critical service providers, and determine the required follow-up actions related to complementary controls, exceptions, or identified limitations.
Identify, assess, and document IT control deficiencies, provide practical recommendations, and monitor remediation plans with relevant stakeholders.
Plan and perform risk-based IT operational internal audits in areas such as cybersecurity, access management, change management, IT operations, third-party IT service providers, technology projects, and critical applications.
Act as a business partner to the IT function to strengthen the IT internal control environment, support the remediation of control deficiencies, and promote the sustainable adoption of control best practices.
Prepare concise management communications on risks, audit findings, recommendations, action plans, and the status of IT-related initiatives and activities.
Support the Internal Audit team in leveraging data analytics to enhance the efficiency, coverage, and value of audit activities, including developing analytical routines using Power BI and other relevant tools.