IT Audit Manager
Invesco · Atlanta, GA · 3 wk ago
Information TechnologyFull-time
We need to output HTML fragment with sections: headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Use
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Use - for any list of duties/requirements/benefits, and
for prose. Do NOT repeat job title as heading. Do NOT put Job ID/requisition numbers as headings. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones.
We need to parse the posting.
The posting includes:
- About Invesco (intro paragraph)
- What’s in it for you? (list of benefits)
- Job Description (intro)
- The Department (description)
- Your Role (list of responsibilities)
- The experience you bring: (list of qualifications/experience/skills)
- Full Time / Part Time: Full time
- Worker Type: Employee
- Job Exempt: Yes
- Workplace Model: description about office days (schedule)
- Then some generic statements about nature of work, other duties, EEO etc. We need to remove EEO boilerplate.
We need to decide sections.
We have:
- About the role? Could be "About the role" maybe from "Your Role" or "Job Description". But we have "About Invesco" which is about company. The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can choose headings that match content.
We have:
- About Invesco (company overview) maybe "About the role"? Not exactly. Could be "About the role" but we have "Your Role". Could use "About the role" heading and put the paragraph describing the role (maybe from "Your Role" intro). But we also have responsibilities list.
Better to have sections: About the role (intro paragraph), Responsibilities (list), Requirements/Qualifications/Skills (maybe combine), Benefits (list), Schedule (workplace model). Pay not mentioned, so omit.
We must not create sections with filler. So we need to ensure each heading has substantive content.
Let's extract substantive content:
Company overview paragraph: "As one of the world’s leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you're looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco."
That's substantive.
What’s in it for you? Benefits list:
- Flexible paid time off
- Hybrid work schedule
- 401(K) matching of 100% up to the first 6% with a discretionary supplemental contribution
- Health & wellbeing benefits
- Parental Leave benefits
- Employee stock purchase plan
These are benefits.
Your Role description paragraph: "As an IT Audit Manager, you will have exciting opportunities to not only enhance your knowledge and familiarity with new technologies and cybersecurity practices across the global organization, but also Invesco products and business processes through integrated reviews covering areas such as Investments, Trading, Distribution, Compliance, and Finance."
Then list of responsibilities (bulleted). We'll extract each bullet.
Responsibilities list:
- Analyzing risk in areas of assigned audit responsibility and preparing proposed internal audit plans based on the results.
- Scheduling and coordinating the planning for specific audit and advisory engagements.
- Collaborating with leadership and colleagues to deliver innovative approaches that meet the objectives of both audit and advisory engagements.
- Preparing audit testing strategies and approaches that meet the objectives of assigned engagements, with a focus on internal control design and testing, including for unstructured, risk-based, or complex audits.
- Performing audit testing and analysis and supervising the performance of work by any assigned staff or contractors, including reviewing workpapers, documenting control weaknesses or inefficiencies and managing the completion of the engagement within the given timeframe.
- Exercising individual judgment and initiative in selecting emphasis for coverage within an engagement and determining and locating sources of information.
- Independently evaluating issues based on impact and importance.
- Preparing results and conducting entry/exit meetings to obtain management concurrence and responses.
- Performing follow-up on previously identified findings and management’s action plans.
- Preparing reports targeted to senior management and corporate directors.
- Assessing emerging technology and cybersecurity risks, including artificial intelligence, cloud services, application and API security, data protection, third-party technology risk, and operational resilience, as part of audit planning and engagement execution.
- Collaborating closely with the Data Analytics team to design, develop, and apply data analytics, automation, and AI-enabled techniques to support risk assessment, audit testing, continuous monitoring, and reporting.
- Assisting in training and development of junior team members by providing on the job coaching and delivering constructive and motivating feedback.
That's responsibilities.
The experience you bring: list of qualifications/requirements/skills.
Let's parse:
- Minimum 5-7 years of experience in technology audit, consulting, or information security roles.
- Bachelor’s degree in Information Systems, Computer Science, Engineering, or Finance preferred. Other business or technology related degrees considered depending upon relevant experience.
- MBA, Master‘s degree in Information Systems, Analytics, Computer Science, Engineering, or Finance a plus.
- Professional auditing, security, or technology designation (e.g., CISSP, CCSP, AWS Cloud Practitioner, CFA, etc.) or to have substantially completed the requirements for such a designation while actively pursuing the completion of such designation preferred.
- Experience within the asset management or securities industries a plus, with knowledge of investment products (equities, fixed income, alternatives), portfolio management, trading and investment operations and finance.
- Experience auditing enterprise and web applications, cybersecurity practices, privacy, application security, API security, secure software development practices, vulnerability management, and infrastructure platforms such as UNIX, Linux, Windows, SQL Server, and Oracle databases.
- Knowledge of and experience auditing networking and firewalls a plus.
- Experience with concepts and auditing of cloud-based platforms (AWS, Microsoft Azure, Google Cloud, Snowflake), services, and applications, including cloud security, configuration management, encryption, logging and monitoring, identity controls, and third-party/SaaS governance.
- Experience designing and conducting data analysis to support audit objectives, including use of data analytics, automation, and AI-enabled techniques to identify risks, trends, anomalies, and control exceptions.
- Experience designing and building continuous auditing or monitoring tools and techniques a plus, including automated control testing, exception reporting, dashboarding, and continuous risk monitoring.
- Excellent written and verbal communication skills.
- Critical thinking and problem-solving ability; effectively identify risks and unexpected patterns in complex situations, investigate issues, analyze root cause, and determine the appropriate course of action.
- Excellent knowledge of leading practices around IT controls, such as the COBIT, NIST, ISO27000, OWASP, and AI governance/control frameworks.
- Strong knowledge of current technology and cybersecurity trends, including artificial intelligence governance, model risk, cloud security, application and API security, identity and access management, data protection, DevSecOps, third-party technology risk, and operational resilience.
- Proficient with analytics software such as Tableau, Power BI, Alteryx, ACL, IDEA, etc. a plus.
- Proficiency in code development, specifically programming languages such as R and Python a plus, including the ability to support audit automation, data validation, analytics scripting, and AI-assisted audit procedures.
- Proficient with Microsoft Office (MS Word, Excel, PowerPoint, Access etc.).
We can treat these as qualifications/requirements/skills. The instruction says use headings like Requirements, Qualifications, Skills. We could combine into one "Requirements" section with list. Or separate into Qualifications and Skills. But we should prefer few substantive sections over many thin ones. So maybe one "Requirements" section containing all.
But we also have "Benefits" section separate.
Schedule: Workplace Model description: "Pursuant to Invesco’s Workplace Policy, employees are expected to comply with the firm’s most current workplace model, which as of October 1, 2025, includes spending at least four full days each week working in an Invesco office. This reflects our belief that spending time together in the office helps us build stronger relationships, collaborate more easily, and support each other’s growth and development."
That's schedule info (office days). So we can have a Schedule section.
Pay: Not mentioned, so omit.
About the role: maybe we can have a short paragraph about the role from "Your Role" intro paragraph (the first sentence). Or we could combine that into Responsibilities. But we need a heading for About the role only if we have substantive content. We have the paragraph: "As an IT Audit Manager, you will have exciting opportunities to not only enhance your knowledge and familiarity with new technologies and cybersecurity practices across the global organization, but also Invesco products and business processes through integrated reviews covering areas such as Investments, Trading, Distribution, Compliance, and Finance." That's substantive. Could be About the role.
Alternatively, we could treat "About Invesco" as "About the role"? Not exactly. But we could have a section "About the role" with that paragraph. Then "Responsibilities" with list. Then "Requirements" with list. Then "Benefits" with list. Then "Schedule" with paragraph.
We must not repeat job title as heading. So we won't put "IT Audit Manager" as heading.
We must not include boilerplate like EEO, etc. Remove those paragraphs.
Also remove duplicated lines: there may be duplicates like "Full Time / Part Time Full time Worker Type Employee Job Exempt (Yes / No) Yes". We'll ignore that as not needed for sections (maybe schedule? but it's about full-time). Could include in Schedule? But schedule already covers office days. The full-time vs part-time is employment type; not schedule. Could be omitted as not required. The instruction says include section only when posting has real, specific content for it. We have schedule content (office days). We have benefits content. We have responsibilities. We have requirements. We have about the role.
Thus output HTML fragment with sections:
About the role
As an IT Audit Manager, you will have exciting opportunities to not only enhance your knowledge and familiarity with new technologies and cybersecurity practices across the global organization, but also Invesco products and business processes through integrated reviews covering areas such as Investments, Trading, Distribution, Compliance, and Finance.
Responsibilities
- Analyzing risk in areas of assigned audit responsibility and preparing proposed internal audit plans based on the results.
- Scheduling and coordinating the planning for specific audit and advisory engagements.
- Collaborating with leadership and colleagues to deliver innovative approaches that meet the objectives of both audit and advisory engagements.
- Preparing audit testing strategies and approaches that meet the objectives of assigned engagements, with a focus on internal control design and testing, including for unstructured, risk-based, or complex audits.
- Performing audit testing and analysis and supervising the performance of work by any assigned staff or contractors, including reviewing workpapers, documenting control weaknesses or inefficiencies and managing the completion of the engagement within the given timeframe.
- Exercising individual judgment and initiative in selecting emphasis for coverage within an engagement and determining and locating sources of information.
- Independently evaluating issues based on impact and importance.
- Preparing results and conducting entry/exit meetings to obtain management concurrence and responses.
- Performing follow
for prose. Do NOT repeat job title as heading. Do NOT put Job ID/requisition numbers as headings. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. We need to parse the posting. The posting includes: - About Invesco (intro paragraph) - What’s in it for you? (list of benefits) - Job Description (intro) - The Department (description) - Your Role (list of responsibilities) - The experience you bring: (list of qualifications/experience/skills) - Full Time / Part Time: Full time - Worker Type: Employee - Job Exempt: Yes - Workplace Model: description about office days (schedule) - Then some generic statements about nature of work, other duties, EEO etc. We need to remove EEO boilerplate. We need to decide sections. We have: - About the role? Could be "About the role" maybe from "Your Role" or "Job Description". But we have "About Invesco" which is about company. The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can choose headings that match content.
We have:
- About Invesco (company overview) maybe "About the role"? Not exactly. Could be "About the role" but we have "Your Role". Could use "About the role" heading and put the paragraph describing the role (maybe from "Your Role" intro). But we also have responsibilities list.
Better to have sections: About the role (intro paragraph), Responsibilities (list), Requirements/Qualifications/Skills (maybe combine), Benefits (list), Schedule (workplace model). Pay not mentioned, so omit.
We must not create sections with filler. So we need to ensure each heading has substantive content.
Let's extract substantive content:
Company overview paragraph: "As one of the world’s leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you're looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco."
That's substantive.
What’s in it for you? Benefits list:
- Flexible paid time off
- Hybrid work schedule
- 401(K) matching of 100% up to the first 6% with a discretionary supplemental contribution
- Health & wellbeing benefits
- Parental Leave benefits
- Employee stock purchase plan
These are benefits.
Your Role description paragraph: "As an IT Audit Manager, you will have exciting opportunities to not only enhance your knowledge and familiarity with new technologies and cybersecurity practices across the global organization, but also Invesco products and business processes through integrated reviews covering areas such as Investments, Trading, Distribution, Compliance, and Finance."
Then list of responsibilities (bulleted). We'll extract each bullet.
Responsibilities list:
- Analyzing risk in areas of assigned audit responsibility and preparing proposed internal audit plans based on the results.
- Scheduling and coordinating the planning for specific audit and advisory engagements.
- Collaborating with leadership and colleagues to deliver innovative approaches that meet the objectives of both audit and advisory engagements.
- Preparing audit testing strategies and approaches that meet the objectives of assigned engagements, with a focus on internal control design and testing, including for unstructured, risk-based, or complex audits.
- Performing audit testing and analysis and supervising the performance of work by any assigned staff or contractors, including reviewing workpapers, documenting control weaknesses or inefficiencies and managing the completion of the engagement within the given timeframe.
- Exercising individual judgment and initiative in selecting emphasis for coverage within an engagement and determining and locating sources of information.
- Independently evaluating issues based on impact and importance.
- Preparing results and conducting entry/exit meetings to obtain management concurrence and responses.
- Performing follow-up on previously identified findings and management’s action plans.
- Preparing reports targeted to senior management and corporate directors.
- Assessing emerging technology and cybersecurity risks, including artificial intelligence, cloud services, application and API security, data protection, third-party technology risk, and operational resilience, as part of audit planning and engagement execution.
- Collaborating closely with the Data Analytics team to design, develop, and apply data analytics, automation, and AI-enabled techniques to support risk assessment, audit testing, continuous monitoring, and reporting.
- Assisting in training and development of junior team members by providing on the job coaching and delivering constructive and motivating feedback.
That's responsibilities.
The experience you bring: list of qualifications/requirements/skills.
Let's parse:
- Minimum 5-7 years of experience in technology audit, consulting, or information security roles.
- Bachelor’s degree in Information Systems, Computer Science, Engineering, or Finance preferred. Other business or technology related degrees considered depending upon relevant experience.
- MBA, Master‘s degree in Information Systems, Analytics, Computer Science, Engineering, or Finance a plus.
- Professional auditing, security, or technology designation (e.g., CISSP, CCSP, AWS Cloud Practitioner, CFA, etc.) or to have substantially completed the requirements for such a designation while actively pursuing the completion of such designation preferred.
- Experience within the asset management or securities industries a plus, with knowledge of investment products (equities, fixed income, alternatives), portfolio management, trading and investment operations and finance.
- Experience auditing enterprise and web applications, cybersecurity practices, privacy, application security, API security, secure software development practices, vulnerability management, and infrastructure platforms such as UNIX, Linux, Windows, SQL Server, and Oracle databases.
- Knowledge of and experience auditing networking and firewalls a plus.
- Experience with concepts and auditing of cloud-based platforms (AWS, Microsoft Azure, Google Cloud, Snowflake), services, and applications, including cloud security, configuration management, encryption, logging and monitoring, identity controls, and third-party/SaaS governance.
- Experience designing and conducting data analysis to support audit objectives, including use of data analytics, automation, and AI-enabled techniques to identify risks, trends, anomalies, and control exceptions.
- Experience designing and building continuous auditing or monitoring tools and techniques a plus, including automated control testing, exception reporting, dashboarding, and continuous risk monitoring.
- Excellent written and verbal communication skills.
- Critical thinking and problem-solving ability; effectively identify risks and unexpected patterns in complex situations, investigate issues, analyze root cause, and determine the appropriate course of action.
- Excellent knowledge of leading practices around IT controls, such as the COBIT, NIST, ISO27000, OWASP, and AI governance/control frameworks.
- Strong knowledge of current technology and cybersecurity trends, including artificial intelligence governance, model risk, cloud security, application and API security, identity and access management, data protection, DevSecOps, third-party technology risk, and operational resilience.
- Proficient with analytics software such as Tableau, Power BI, Alteryx, ACL, IDEA, etc. a plus.
- Proficiency in code development, specifically programming languages such as R and Python a plus, including the ability to support audit automation, data validation, analytics scripting, and AI-assisted audit procedures.
- Proficient with Microsoft Office (MS Word, Excel, PowerPoint, Access etc.).
We can treat these as qualifications/requirements/skills. The instruction says use headings like Requirements, Qualifications, Skills. We could combine into one "Requirements" section with list. Or separate into Qualifications and Skills. But we should prefer few substantive sections over many thin ones. So maybe one "Requirements" section containing all.
But we also have "Benefits" section separate.
Schedule: Workplace Model description: "Pursuant to Invesco’s Workplace Policy, employees are expected to comply with the firm’s most current workplace model, which as of October 1, 2025, includes spending at least four full days each week working in an Invesco office. This reflects our belief that spending time together in the office helps us build stronger relationships, collaborate more easily, and support each other’s growth and development."
That's schedule info (office days). So we can have a Schedule section.
Pay: Not mentioned, so omit.
About the role: maybe we can have a short paragraph about the role from "Your Role" intro paragraph (the first sentence). Or we could combine that into Responsibilities. But we need a heading for About the role only if we have substantive content. We have the paragraph: "As an IT Audit Manager, you will have exciting opportunities to not only enhance your knowledge and familiarity with new technologies and cybersecurity practices across the global organization, but also Invesco products and business processes through integrated reviews covering areas such as Investments, Trading, Distribution, Compliance, and Finance." That's substantive. Could be About the role.
Alternatively, we could treat "About Invesco" as "About the role"? Not exactly. But we could have a section "About the role" with that paragraph. Then "Responsibilities" with list. Then "Requirements" with list. Then "Benefits" with list. Then "Schedule" with paragraph.
We must not repeat job title as heading. So we won't put "IT Audit Manager" as heading.
We must not include boilerplate like EEO, etc. Remove those paragraphs.
Also remove duplicated lines: there may be duplicates like "Full Time / Part Time Full time Worker Type Employee Job Exempt (Yes / No) Yes". We'll ignore that as not needed for sections (maybe schedule? but it's about full-time). Could include in Schedule? But schedule already covers office days. The full-time vs part-time is employment type; not schedule. Could be omitted as not required. The instruction says include section only when posting has real, specific content for it. We have schedule content (office days). We have benefits content. We have responsibilities. We have requirements. We have about the role.
Thus output HTML fragment with sections:
About the role
As an IT Audit Manager, you will have exciting opportunities to not only enhance your knowledge and familiarity with new technologies and cybersecurity practices across the global organization, but also Invesco products and business processes through integrated reviews covering areas such as Investments, Trading, Distribution, Compliance, and Finance.
Responsibilities
- Analyzing risk in areas of assigned audit responsibility and preparing proposed internal audit plans based on the results.
- Scheduling and coordinating the planning for specific audit and advisory engagements.
- Collaborating with leadership and colleagues to deliver innovative approaches that meet the objectives of both audit and advisory engagements.
- Preparing audit testing strategies and approaches that meet the objectives of assigned engagements, with a focus on internal control design and testing, including for unstructured, risk-based, or complex audits.
- Performing audit testing and analysis and supervising the performance of work by any assigned staff or contractors, including reviewing workpapers, documenting control weaknesses or inefficiencies and managing the completion of the engagement within the given timeframe.
- Exercising individual judgment and initiative in selecting emphasis for coverage within an engagement and determining and locating sources of information.
- Independently evaluating issues based on impact and importance.
- Preparing results and conducting entry/exit meetings to obtain management concurrence and responses.
- Performing follow