IT Audit Advisory - Senior Associate
CohnReznick · Parsippany, NJ · 3 wk ago
Hybrid$85k–$140k/yrFull-time
We need to output HTML fragment with headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. Must not repeat job title. Must not include Job ID etc. Remove boilerplate.
We need to parse the job description and extract content.
Sections:
- About the role: maybe a brief description of the role, team, why CohnReznick? The description includes "YOUR TEAM." "WHY COHNREZNICK?" "YOUR ROLE." Could combine into About the role. But we need to decide.
We need to include sections only if there is real specific content.
Let's identify content:
About the role: Could be the introductory paragraph: "As CohnReznick grows... We currently have an exciting career opportunity for a Senior Associate to join the Cybersecurity & Digital Trust team in our Risk Advisory practice." Also mention hybrid firm, expected in-office 3 days a week. That's schedule info though.
Responsibilities: The bullet list under "Responsibilities Include But Not Limited To" and sub-sections: IT Audit & IT Risk, Cybersecurity & CMMC Assessments, Client Delivery & Engagement Support, Team Collaboration & Development.
Requirements: maybe "Your Experience." includes degree, years experience, hands-on experience, etc.
Qualifications: maybe certifications: CISA strongly preferred, CCA, etc.
Skills: maybe technical skills: understanding of frameworks, cloud security, IAM, etc.
Benefits: The description mentions "We invest in a robust Total Rewards package that includes everything from generous PTO, a flexible work environment, expanded parental leave, extensive learning & development, and even paid time off for employees to volunteer." Also later: "In New Jersey, the salary range for a Senior Associate is $85,000 to $140,000. Salary is one component of the CohnReznick total rewards package, which includes a discretionary performance bonus, generous paid time off, expanded, and inclusive parental benefits, and access to best-in-class learning and development platforms, to name a few."
Pay: salary range.
Schedule: hybrid, expected in-office 3 days a week.
We must not create sections with filler like "commensurate with experience". We have actual content.
We need to output only HTML fragment, no /, no markdown fences.
We'll produce sections:
for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. Must not repeat job title. Must not include Job ID etc. Remove boilerplate.
We need to parse the job description and extract content.
Sections:
- About the role: maybe a brief description of the role, team, why CohnReznick? The description includes "YOUR TEAM." "WHY COHNREZNICK?" "YOUR ROLE." Could combine into About the role. But we need to decide.
We need to include sections only if there is real specific content.
Let's identify content:
About the role: Could be the introductory paragraph: "As CohnReznick grows... We currently have an exciting career opportunity for a Senior Associate to join the Cybersecurity & Digital Trust team in our Risk Advisory practice." Also mention hybrid firm, expected in-office 3 days a week. That's schedule info though.
Responsibilities: The bullet list under "Responsibilities Include But Not Limited To" and sub-sections: IT Audit & IT Risk, Cybersecurity & CMMC Assessments, Client Delivery & Engagement Support, Team Collaboration & Development.
Requirements: maybe "Your Experience." includes degree, years experience, hands-on experience, etc.
Qualifications: maybe certifications: CISA strongly preferred, CCA, etc.
Skills: maybe technical skills: understanding of frameworks, cloud security, IAM, etc.
Benefits: The description mentions "We invest in a robust Total Rewards package that includes everything from generous PTO, a flexible work environment, expanded parental leave, extensive learning & development, and even paid time off for employees to volunteer." Also later: "In New Jersey, the salary range for a Senior Associate is $85,000 to $140,000. Salary is one component of the CohnReznick total rewards package, which includes a discretionary performance bonus, generous paid time off, expanded, and inclusive parental benefits, and access to best-in-class learning and development platforms, to name a few."
Pay: salary range.
Schedule: hybrid, expected in-office 3 days a week.
We must not create sections with filler like "commensurate with experience". We have actual content.
We need to output only HTML fragment, no /, no markdown fences.
We'll produce sections:
About the role
with paragraphs describing the role, team, why CohnReznick, hybrid nature.
Responsibilities
with - items. Could group sub-responsibilities as separate
- with maybe nested? But spec says use
- for any list of duties/requirements/benefits. So we can have a flat list of responsibilities. Could break into multiple
- each covering a bullet.
We need to preserve all substantive information; do not invent or summarize away detail. So we need to include details from each bullet.
Let's extract responsibilities details:
From "Responsibilities Include But Not Limited To The Senior Associate will support and lead the execution of IT audit, IT risk management, and cybersecurity assessment engagements for a diverse client base, including organizations subject to regulatory, contractual, and federal cybersecurity requirements. This role will play a key part in performing risk‑based IT audits, cyber maturity and compliance assessments, and advisory services. The Senior Associate is expected to work independently on assigned areas, contribute to client deliverables, mentor junior staff, and collaborate closely with Managers and Partners to deliver high‑quality, practical solutions."
Then sub-sections:
". IT Audit & IT Risk Execute and support risk‑based IT audits and IT risk assessments, including evaluation of IT general controls (ITGCs), automated application controls, and key technology‑enabled business processes. Assess control design and operating effectiveness across domains such as access management, change management, system development lifecycle (SDLC), incident response, and vendor management. Support SOX‑relevant IT controls testing, internal audit co‑sourcing, and other compliance‑driven engagements as applicable. Identify control gaps, assess risk impact, and develop clear, actionable recommendations for remediation."
"Cybersecurity & CMMC Assessments Perform cybersecurity assessments and readiness reviews aligned to CMMC, NIST SP 800‑171, NIST CSF, ISO27001, and other recognized frameworks. Support or lead CMMC gap assessments, readiness assessments, and advisory activities for organizations in the Defense Industrial Base (DIB). Assist in evidence collection, validation, and analysis for cybersecurity and compliance assessments. Contribute to development of client deliverables, including assessment reports, risk summaries, and management presentations."
"Client Delivery & Engagement Support Serve as a day‑to‑day engagement team member, managing assigned workstreams and coordinating with team members and client stakeholders. Simultaneously serve multiple engagements while maintaining high quality standards Work with clients in a broad array of industries including information technology, financial services, retail & consumer products, pharmaceuticals, electronics, manufacturing, media, and government contracting etc. Facilitate client interviews and walkthroughs to understand IT environments, security controls, and operational processes. Ensure workpapers and deliverables meet quality, consistency, and documentation standards. Understand clients’ organizations and provide value-added solutions and best practices Identify emerging risks, trends, and improvement opportunities for clients."
"Team Collaboration & Development Mentor and review work performed by Consultants and Analysts. Share knowledge and best practices related to IT audit, cybersecurity, and CMMC requirements. Contribute to internal methodology development, tools, and training initiatives."
We'll turn each of these into
- items.
Now Requirements: "Your Experience. The successful candidate will have: Bachelor’s degree in Information Systems, Computer Science, Accounting, Cybersecurity, or a related field. 4+ years of relevant experience in IT audit, IT risk, cybersecurity, or technology advisory roles. Hands‑on experience performing IT audits, IT risk assessments, or cybersecurity assessments. Strong understanding of internal controls, risk management concepts, and common cybersecurity frameworks. Background and understanding of the risks and controls in technologies such as web, cloud, client/server, open systems architecture, data warehousing, and imaging Proficient understanding of cloud security, Identity and Access Management, ERP, Operating Systems, Databases, and Network Infrastructure components Knowledge of risk and controls related to emerging technologies such as AI, blockchain, and automation. Working knowledge of Cloud Security Framework, General Data Protection Requirement (GDPR), COBIT 5, ISO 27001/2, HIPAA, California Consumer Protection Act (CCPA), NIST 800-171/800-53/NIST 800-37 Excellent written and verbal communication skills, with the ability to explain technical concepts to non‑technical audiences. Ability to manage multiple priorities and work effectively in a client‑facing consulting environment. Participate in business development activities such as proposal writing, professional networking, and thought leadership development"
We can put these as
- items.
Qualifications: maybe certifications: "Certified Information Systems Auditor (CISA) – strongly preferred. Certified CMMC Assessor (CCA) or active progress toward CMMC Assessor certification – strongly preferred. Additional certifications a plus, such as: Experience supporting federal, government contractor, or regulated industry clients. Ability to work onsite 3 days per week, and travel up to 50% (domestic and international)" Actually travel and onsite could be schedule/requirements. But we can treat certifications as Qualifications.
Skills: maybe technical skills: understanding of frameworks, cloud security, IAM, etc. But many of those are already in Requirements. Could separate: Skills could be "Excellent written and verbal communication skills, ability to explain technical concepts to non‑technical audiences, ability to manage multiple priorities, work effectively in client‑facing consulting environment, participate in business development activities." But that's overlapping.
Better to follow the headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We need to decide what goes where.
Let's map:
About the role: introductory paragraphs about the firm, team, why CohnReznick, hybrid nature.
Responsibilities: as extracted.
Requirements: education, years experience, hands-on experience, understanding of internal controls, etc. Could also include ability to work onsite 3 days per week and travel up to 50%? That's more schedule/requirements but we have separate Schedule section.
Qualifications: certifications (CISA, CCA), maybe additional certifications a plus.
Skills: maybe technical skills like cloud security, IAM, ERP, OS, DB, network infra, emerging tech, frameworks (GDPR, COBIT, ISO, HIPAA, CCPA, NIST), communication skills, etc. But many of those are already in Requirements. To avoid duplication, we could put technical knowledge under Skills, and experience/education under Requirements.
Let's split:
Requirements: Bachelor’s degree, 4+ years relevant experience, hands-on experience performing IT audits/risk assessments/cybersecurity assessments.
Skills: Strong understanding of internal controls, risk management concepts, common cybersecurity frameworks; background/understanding of risks and controls in technologies (web, cloud, client/server, open systems, data warehousing, imaging); proficient understanding of cloud security, IAM, ERP, OS, DB, network infra; knowledge of risk and controls related to emerging tech (AI, blockchain, automation); working knowledge of Cloud Security Framework, GDPR, COBIT 5, ISO 27001/2, HIPAA, CCPA, NIST 800-171/800-53/800-37; excellent written and verbal communication skills; ability to manage multiple priorities; ability to work effectively in client‑facing consulting environment; participate in business development activities.
Qualifications: CISA strongly preferred; CCA or active progress toward CMMC Assessor certification strongly preferred; additional certifications a plus; experience supporting federal, government contractor, or regulated industry clients.
Benefits: generous PTO, flexible work environment, expanded parental leave, extensive learning & development, paid time off for volunteering, discretionary performance bonus, generous paid time off (maybe duplicate), expanded and inclusive parental benefits, access to best-in-class learning and development platforms.
Pay: salary range $85,000 to $140,000 (New Jersey). Also mention discretionary performance bonus as part of total rewards but we already have benefits.
Schedule: hybrid, expected in-office/together in person on average 3 days a week. Also mention ability to work onsite 3 days per week (same). Also travel up to 50% domestic and international.
We must not create sections with filler like "not specified". We have real content.
Now produce HTML.
We'll need to wrap each section in
heading then content.
For lists: - ...
For prose:
...
We must not repeat job title.
Let's craft.
About the role: combine paragraphs:
Paragraph 1: "As CohnReznick grows, so do our career opportunities. As one of the nation’s top professional services firms, CohnReznick creates rewarding careers in advisory, assurance, and tax with team members who value innovation and collaboration in everything they do! CohnReznick helps organizations optimize performance, manage risk, and maximize value through CohnReznick LLP (assurance services) and CohnReznick Advisory LLC (advisory and tax services). Together, the firm provides leaders with deep industry knowledge and relationships, solutions to address clients’ unique business goals and risks, and insight on how emerging market forces can drive opportunity. With offices nationwide, the firm serves organizations around the world as an independent member of Nexia."
Paragraph 2: "We currently have an exciting career opportunity for a Senior Associate to join the Cybersecurity & Digital Trust team in our Risk Advisory practice. CohnReznick is a hybrid firm and most of our professionals are located within a commutable distance to one of
- for any list of duties/requirements/benefits. So we can have a flat list of responsibilities. Could break into multiple
- each covering a bullet. We need to preserve all substantive information; do not invent or summarize away detail. So we need to include details from each bullet. Let's extract responsibilities details: From "Responsibilities Include But Not Limited To The Senior Associate will support and lead the execution of IT audit, IT risk management, and cybersecurity assessment engagements for a diverse client base, including organizations subject to regulatory, contractual, and federal cybersecurity requirements. This role will play a key part in performing risk‑based IT audits, cyber maturity and compliance assessments, and advisory services. The Senior Associate is expected to work independently on assigned areas, contribute to client deliverables, mentor junior staff, and collaborate closely with Managers and Partners to deliver high‑quality, practical solutions." Then sub-sections: ". IT Audit & IT Risk Execute and support risk‑based IT audits and IT risk assessments, including evaluation of IT general controls (ITGCs), automated application controls, and key technology‑enabled business processes. Assess control design and operating effectiveness across domains such as access management, change management, system development lifecycle (SDLC), incident response, and vendor management. Support SOX‑relevant IT controls testing, internal audit co‑sourcing, and other compliance‑driven engagements as applicable. Identify control gaps, assess risk impact, and develop clear, actionable recommendations for remediation." "Cybersecurity & CMMC Assessments Perform cybersecurity assessments and readiness reviews aligned to CMMC, NIST SP 800‑171, NIST CSF, ISO27001, and other recognized frameworks. Support or lead CMMC gap assessments, readiness assessments, and advisory activities for organizations in the Defense Industrial Base (DIB). Assist in evidence collection, validation, and analysis for cybersecurity and compliance assessments. Contribute to development of client deliverables, including assessment reports, risk summaries, and management presentations." "Client Delivery & Engagement Support Serve as a day‑to‑day engagement team member, managing assigned workstreams and coordinating with team members and client stakeholders. Simultaneously serve multiple engagements while maintaining high quality standards Work with clients in a broad array of industries including information technology, financial services, retail & consumer products, pharmaceuticals, electronics, manufacturing, media, and government contracting etc. Facilitate client interviews and walkthroughs to understand IT environments, security controls, and operational processes. Ensure workpapers and deliverables meet quality, consistency, and documentation standards. Understand clients’ organizations and provide value-added solutions and best practices Identify emerging risks, trends, and improvement opportunities for clients." "Team Collaboration & Development Mentor and review work performed by Consultants and Analysts. Share knowledge and best practices related to IT audit, cybersecurity, and CMMC requirements. Contribute to internal methodology development, tools, and training initiatives." We'll turn each of these into
- items.
Now Requirements: "Your Experience. The successful candidate will have: Bachelor’s degree in Information Systems, Computer Science, Accounting, Cybersecurity, or a related field. 4+ years of relevant experience in IT audit, IT risk, cybersecurity, or technology advisory roles. Hands‑on experience performing IT audits, IT risk assessments, or cybersecurity assessments. Strong understanding of internal controls, risk management concepts, and common cybersecurity frameworks. Background and understanding of the risks and controls in technologies such as web, cloud, client/server, open systems architecture, data warehousing, and imaging Proficient understanding of cloud security, Identity and Access Management, ERP, Operating Systems, Databases, and Network Infrastructure components Knowledge of risk and controls related to emerging technologies such as AI, blockchain, and automation. Working knowledge of Cloud Security Framework, General Data Protection Requirement (GDPR), COBIT 5, ISO 27001/2, HIPAA, California Consumer Protection Act (CCPA), NIST 800-171/800-53/NIST 800-37 Excellent written and verbal communication skills, with the ability to explain technical concepts to non‑technical audiences. Ability to manage multiple priorities and work effectively in a client‑facing consulting environment. Participate in business development activities such as proposal writing, professional networking, and thought leadership development"
We can put these as
- items.
Qualifications: maybe certifications: "Certified Information Systems Auditor (CISA) – strongly preferred. Certified CMMC Assessor (CCA) or active progress toward CMMC Assessor certification – strongly preferred. Additional certifications a plus, such as: Experience supporting federal, government contractor, or regulated industry clients. Ability to work onsite 3 days per week, and travel up to 50% (domestic and international)" Actually travel and onsite could be schedule/requirements. But we can treat certifications as Qualifications.
Skills: maybe technical skills: understanding of frameworks, cloud security, IAM, etc. But many of those are already in Requirements. Could separate: Skills could be "Excellent written and verbal communication skills, ability to explain technical concepts to non‑technical audiences, ability to manage multiple priorities, work effectively in client‑facing consulting environment, participate in business development activities." But that's overlapping.
Better to follow the headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We need to decide what goes where.
Let's map:
About the role: introductory paragraphs about the firm, team, why CohnReznick, hybrid nature.
Responsibilities: as extracted.
Requirements: education, years experience, hands-on experience, understanding of internal controls, etc. Could also include ability to work onsite 3 days per week and travel up to 50%? That's more schedule/requirements but we have separate Schedule section.
Qualifications: certifications (CISA, CCA), maybe additional certifications a plus.
Skills: maybe technical skills like cloud security, IAM, ERP, OS, DB, network infra, emerging tech, frameworks (GDPR, COBIT, ISO, HIPAA, CCPA, NIST), communication skills, etc. But many of those are already in Requirements. To avoid duplication, we could put technical knowledge under Skills, and experience/education under Requirements.
Let's split:
Requirements: Bachelor’s degree, 4+ years relevant experience, hands-on experience performing IT audits/risk assessments/cybersecurity assessments.
Skills: Strong understanding of internal controls, risk management concepts, common cybersecurity frameworks; background/understanding of risks and controls in technologies (web, cloud, client/server, open systems, data warehousing, imaging); proficient understanding of cloud security, IAM, ERP, OS, DB, network infra; knowledge of risk and controls related to emerging tech (AI, blockchain, automation); working knowledge of Cloud Security Framework, GDPR, COBIT 5, ISO 27001/2, HIPAA, CCPA, NIST 800-171/800-53/800-37; excellent written and verbal communication skills; ability to manage multiple priorities; ability to work effectively in client‑facing consulting environment; participate in business development activities.
Qualifications: CISA strongly preferred; CCA or active progress toward CMMC Assessor certification strongly preferred; additional certifications a plus; experience supporting federal, government contractor, or regulated industry clients.
Benefits: generous PTO, flexible work environment, expanded parental leave, extensive learning & development, paid time off for volunteering, discretionary performance bonus, generous paid time off (maybe duplicate), expanded and inclusive parental benefits, access to best-in-class learning and development platforms.
Pay: salary range $85,000 to $140,000 (New Jersey). Also mention discretionary performance bonus as part of total rewards but we already have benefits.
Schedule: hybrid, expected in-office/together in person on average 3 days a week. Also mention ability to work onsite 3 days per week (same). Also travel up to 50% domestic and international.
We must not create sections with filler like "not specified". We have real content.
Now produce HTML.
We'll need to wrap each section in
heading then content. For lists:
- ...
...
We must not repeat job title. Let's craft. About the role: combine paragraphs: Paragraph 1: "As CohnReznick grows, so do our career opportunities. As one of the nation’s top professional services firms, CohnReznick creates rewarding careers in advisory, assurance, and tax with team members who value innovation and collaboration in everything they do! CohnReznick helps organizations optimize performance, manage risk, and maximize value through CohnReznick LLP (assurance services) and CohnReznick Advisory LLC (advisory and tax services). Together, the firm provides leaders with deep industry knowledge and relationships, solutions to address clients’ unique business goals and risks, and insight on how emerging market forces can drive opportunity. With offices nationwide, the firm serves organizations around the world as an independent member of Nexia." Paragraph 2: "We currently have an exciting career opportunity for a Senior Associate to join the Cybersecurity & Digital Trust team in our Risk Advisory practice. CohnReznick is a hybrid firm and most of our professionals are located within a commutable distance to one of
- items.
Qualifications: maybe certifications: "Certified Information Systems Auditor (CISA) – strongly preferred. Certified CMMC Assessor (CCA) or active progress toward CMMC Assessor certification – strongly preferred. Additional certifications a plus, such as: Experience supporting federal, government contractor, or regulated industry clients. Ability to work onsite 3 days per week, and travel up to 50% (domestic and international)" Actually travel and onsite could be schedule/requirements. But we can treat certifications as Qualifications.
Skills: maybe technical skills: understanding of frameworks, cloud security, IAM, etc. But many of those are already in Requirements. Could separate: Skills could be "Excellent written and verbal communication skills, ability to explain technical concepts to non‑technical audiences, ability to manage multiple priorities, work effectively in client‑facing consulting environment, participate in business development activities." But that's overlapping.
Better to follow the headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We need to decide what goes where.
Let's map:
About the role: introductory paragraphs about the firm, team, why CohnReznick, hybrid nature.
Responsibilities: as extracted.
Requirements: education, years experience, hands-on experience, understanding of internal controls, etc. Could also include ability to work onsite 3 days per week and travel up to 50%? That's more schedule/requirements but we have separate Schedule section.
Qualifications: certifications (CISA, CCA), maybe additional certifications a plus.
Skills: maybe technical skills like cloud security, IAM, ERP, OS, DB, network infra, emerging tech, frameworks (GDPR, COBIT, ISO, HIPAA, CCPA, NIST), communication skills, etc. But many of those are already in Requirements. To avoid duplication, we could put technical knowledge under Skills, and experience/education under Requirements.
Let's split:
Requirements: Bachelor’s degree, 4+ years relevant experience, hands-on experience performing IT audits/risk assessments/cybersecurity assessments.
Skills: Strong understanding of internal controls, risk management concepts, common cybersecurity frameworks; background/understanding of risks and controls in technologies (web, cloud, client/server, open systems, data warehousing, imaging); proficient understanding of cloud security, IAM, ERP, OS, DB, network infra; knowledge of risk and controls related to emerging tech (AI, blockchain, automation); working knowledge of Cloud Security Framework, GDPR, COBIT 5, ISO 27001/2, HIPAA, CCPA, NIST 800-171/800-53/800-37; excellent written and verbal communication skills; ability to manage multiple priorities; ability to work effectively in client‑facing consulting environment; participate in business development activities.
Qualifications: CISA strongly preferred; CCA or active progress toward CMMC Assessor certification strongly preferred; additional certifications a plus; experience supporting federal, government contractor, or regulated industry clients.
Benefits: generous PTO, flexible work environment, expanded parental leave, extensive learning & development, paid time off for volunteering, discretionary performance bonus, generous paid time off (maybe duplicate), expanded and inclusive parental benefits, access to best-in-class learning and development platforms.
Pay: salary range $85,000 to $140,000 (New Jersey). Also mention discretionary performance bonus as part of total rewards but we already have benefits.
Schedule: hybrid, expected in-office/together in person on average 3 days a week. Also mention ability to work onsite 3 days per week (same). Also travel up to 50% domestic and international.
We must not create sections with filler like "not specified". We have real content.
Now produce HTML.
We'll need to wrap each section in