IT Audit, Risk and Cybersecurity - Senior Associate
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We can choose which sections to include based on content.
We must not repeat job title as heading. No Job ID. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "Universal Job Standards" etc. Also remove the long legal disclaimer about equal opportunity etc. Also remove the bit about "CohnReznick LLP and Advisory LLC..." etc. Also remove the bit about "Please note: This email address is reserved..." etc. Also remove the hashtag #GD.
We need to preserve all substantive information. So we need to keep description of firm, team, why, role responsibilities, experience requirements, benefits, pay, schedule.
We must not invent or summarize away detail. So we need to keep specifics like "4+ years of relevant experience", "Bachelor’s degree in Information Systems, Computer Science, Accounting, Cybersecurity, or a related field." etc. Also list of frameworks: CMMC, NIST SP 800‑171, NIST CSF, ISO27001, etc. Also list of technologies: web, cloud, client/server, open systems architecture, data warehousing, imaging. Also list of certifications: CISA strongly preferred, Certified CMMC Assessor (CCA) or active progress toward CMMC Assessor certification – strongly preferred. Additional certifications a plus, such as: (but the list after that is cut off? Actually after "Additional certifications a plus, such as:" there is line break then "Experience supporting federal, government contractor, or regulated industry clients." That seems like a bullet? Actually it's part of qualifications. We'll keep that sentence.
Also "Ability to work onsite 3 days per week, and travel up to 50% (domestic and international)". That's schedule and travel.
We need to format lists with - . For responsibilities we have many bullet-like sentences separated by periods. We need to turn them into list items. The responsibilities section includes multiple paragraphs: "IT Audit & IT Risk Execute and support risk‑based IT audits...". We can split each sentence into list items. But we must preserve all substantive information; we can keep them as list items.
Similarly for "Your Experience." we can list each qualification as list items.
Benefits: "We invest in a robust Total Rewards package that includes everything from generous PTO, a flexible work environment, expanded parental leave, extensive learning & development, and even paid time off for employees to volunteer." Also later: "Salary is one component of the CohnReznick total rewards package, which includes a discretionary performance bonus, generous paid time off, expanded, and inclusive parental benefits, and access to best-in-class learning and development platforms, to name a few." We'll combine.
Pay: "In New Jersey, the salary range for a Senior Associate is $85,000 to $140,000."
Schedule: hybrid, expected 3 days a week in office. Also mention travel up to 50% (domestic and international). Travel could be part of schedule or maybe separate but we can include in Schedule section.
We must not create sections with filler like "commensurate with experience". We have actual specifics.
Now produce HTML fragment.
Structure:
About the role
... description of firm and team? Actually "About the role" could be the introductory paragraphs about the firm and the team. We'll include a paragraph summarizing the firm description and team description.
But we must not repeat job title. So we can put a paragraph about the firm and the team.
Let's extract: "As CohnReznick grows, so do our career opportunities. As one of the nation’s top professional services firms, CohnReznick creates rewarding careers in advisory, assurance, and tax with team members who value innovation and collaboration in everything they do! CohnReznick helps organizations optimize performance, manage risk, and maximize value through CohnReznick LLP (assurance services) and CohnReznick Advisory LLC (advisory and tax services). Together, the firm provides leaders with deep industry knowledge and relationships, solutions to address clients’ unique business goals and risks, and insight on how emerging market forces can drive opportunity. With offices nationwide, the firm serves organizations around the world as an independent member of Nexia. We currently have an exciting career opportunity for a Senior Associate to join the Cybersecurity & Digital Trust team in our Risk Advisory practice. CohnReznick is a hybrid firm and most of our professionals are located within a commutable distance to one of our offices. This position is considered hybrid which means team members are expected to be thoughtful and intentional in how they create opportunities for in-person collaboration. While the cadence of in-office presence is determined at the team level, our professionals are encouraged to be in the office/together in person on average 3 days a week."
Then "YOUR TEAM. Join a diverse team of fun-loving, energetic professionals with decades of experience managing security, technology, and privacy risks in nearly every industry sector who have a passion for creating tailored solutions that go beyond technology offerings or tools and help clients reduce cost of compliance while mitigating risks."
Then "WHY COHNREZNICK? At CohnReznick, we’re united by a common mission to create opportunity, value, and trust for our clients, our people, and our communities. Whether it’s working alongside your peers to solve a client challenge, or volunteering together at the local food bank, there are so many ways to find your “why” at the firm. We believe it’s important to balance work with everyday life – and make time for enjoyment and fun. We invest in a robust Total Rewards package that includes everything from generous PTO, a flexible work environment, expanded parental leave, extensive learning & development, and even paid time off for employees to volunteer."
We could combine About the role and Why CohnReznick? But we need sections. Perhaps About the role includes firm description and team description. Why CohnReznick? could be part of Benefits? Actually benefits already includes Total Rewards. The "Why CohnReznick?" is more about culture and mission. Could be part of About the role or separate section like "About the firm". But headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. No "Why". So we can incorporate that into Benefits or About the role. Since Benefits already covers Total Rewards, we could add culture points there. But we must not invent. We'll include the "Why CohnReznick?" content in Benefits section as part of description.
Thus:
About the role
[firm description + team description + hybrid expectation]
Responsibilities
- Execute and support risk‑based IT audits and IT risk assessments, including evaluation of IT general controls (ITGCs), automated application controls, and key technology‑enabled business processes.
- Assess control design and operating effectiveness across domains such as access management, change management, system development lifecycle (SDLC), incident response, and vendor management.
- Support SOX‑relevant IT controls testing, internal audit co‑sourcing, and other compliance‑driven engagements as applicable.
- Identify control gaps, assess risk impact, and develop clear, actionable recommendations for remediation.
- Perform cybersecurity assessments and readiness reviews aligned to CMMC, NIST SP 800‑171, NIST CSF, ISO27001, and other recognized frameworks.
- Support or lead CMMC gap assessments, readiness assessments, and advisory activities for organizations in the Defense Industrial Base (DIB).
- Assist in evidence collection, validation, and analysis for cybersecurity and compliance assessments.
- Contribute to development of client deliverables, including assessment reports, risk summaries, and management presentations.
- Serve as a day‑to‑day engagement team member, managing assigned workstreams and coordinating with team members and client stakeholders.
- Simultaneously serve multiple engagements while maintaining high quality standards.
- Work with clients in a broad array of industries including information technology, financial services, retail & consumer products, pharmaceuticals, electronics, manufacturing, media, and government contracting etc.
- Facilitate client interviews and walkthroughs to understand IT environments, security controls, and operational processes.
- Ensure workpapers and deliverables meet quality, consistency, and documentation standards.
- Understand clients’ organizations and provide value‑added solutions and best practices.
- Identify emerging risks, trends, and improvement opportunities for clients.
- Mentor and review work performed by Consultants and Analysts.
- Share knowledge and best practices related to IT audit, cybersecurity, and CMMC requirements.
- Contribute to internal methodology development, tools, and training initiatives.
Requirements
- Bachelor’s degree in Information Systems, Computer Science, Accounting, Cybersecurity, or a related field.
- 4+ years of relevant experience in IT audit, IT risk, cybersecurity, or technology advisory roles.
- Hands‑on experience performing IT audits, IT risk assessments, or cybersecurity assessments.
- Strong understanding of internal controls, risk management concepts, and common cybersecurity frameworks.
- Background and understanding of the risks and controls in technologies such as web, cloud, client/server, open systems architecture, data warehousing, and imaging.
- Proficient understanding of cloud security, Identity and Access Management, ERP, Operating Systems, Databases, and Network Infrastructure components.
- Knowledge of risk and controls related to emerging technologies such as AI, blockchain, and automation.
- Working knowledge of Cloud Security Framework, General Data Protection Requirement (GDPR), COBIT 5, ISO 27001/2, HIPAA, California Consumer Protection Act (CCPA), NIST 800-171/800-53/NIST 800-37.
- Excellent written and verbal communication skills, with the ability to explain technical concepts to non‑technical audiences.
- Ability to manage multiple priorities and work effectively in a client‑facing consulting environment.
- Participate in business development activities such as proposal writing, professional networking, and thought leadership development.
- Certified Information Systems Auditor (CISA) – strongly preferred.
- Certified CMMC Assessor (CCA) or active progress toward CMMC Assessor certification – strongly preferred.
- Additional certifications a plus.
- Experience supporting federal, government contractor, or regulated industry
About the role
... description of firm and team? Actually "About the role" could be the introductory paragraphs about the firm and the team. We'll include a paragraph summarizing the firm description and team description. But we must not repeat job title. So we can put a paragraph about the firm and the team. Let's extract: "As CohnReznick grows, so do our career opportunities. As one of the nation’s top professional services firms, CohnReznick creates rewarding careers in advisory, assurance, and tax with team members who value innovation and collaboration in everything they do! CohnReznick helps organizations optimize performance, manage risk, and maximize value through CohnReznick LLP (assurance services) and CohnReznick Advisory LLC (advisory and tax services). Together, the firm provides leaders with deep industry knowledge and relationships, solutions to address clients’ unique business goals and risks, and insight on how emerging market forces can drive opportunity. With offices nationwide, the firm serves organizations around the world as an independent member of Nexia. We currently have an exciting career opportunity for a Senior Associate to join the Cybersecurity & Digital Trust team in our Risk Advisory practice. CohnReznick is a hybrid firm and most of our professionals are located within a commutable distance to one of our offices. This position is considered hybrid which means team members are expected to be thoughtful and intentional in how they create opportunities for in-person collaboration. While the cadence of in-office presence is determined at the team level, our professionals are encouraged to be in the office/together in person on average 3 days a week." Then "YOUR TEAM. Join a diverse team of fun-loving, energetic professionals with decades of experience managing security, technology, and privacy risks in nearly every industry sector who have a passion for creating tailored solutions that go beyond technology offerings or tools and help clients reduce cost of compliance while mitigating risks." Then "WHY COHNREZNICK? At CohnReznick, we’re united by a common mission to create opportunity, value, and trust for our clients, our people, and our communities. Whether it’s working alongside your peers to solve a client challenge, or volunteering together at the local food bank, there are so many ways to find your “why” at the firm. We believe it’s important to balance work with everyday life – and make time for enjoyment and fun. We invest in a robust Total Rewards package that includes everything from generous PTO, a flexible work environment, expanded parental leave, extensive learning & development, and even paid time off for employees to volunteer." We could combine About the role and Why CohnReznick? But we need sections. Perhaps About the role includes firm description and team description. Why CohnReznick? could be part of Benefits? Actually benefits already includes Total Rewards. The "Why CohnReznick?" is more about culture and mission. Could be part of About the role or separate section like "About the firm". But headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. No "Why". So we can incorporate that into Benefits or About the role. Since Benefits already covers Total Rewards, we could add culture points there. But we must not invent. We'll include the "Why CohnReznick?" content in Benefits section as part of description. Thus:
About the role
[firm description + team description + hybrid expectation]
Responsibilities
- Execute and support risk‑based IT audits and IT risk assessments, including evaluation of IT general controls (ITGCs), automated application controls, and key technology‑enabled business processes.
- Assess control design and operating effectiveness across domains such as access management, change management, system development lifecycle (SDLC), incident response, and vendor management.
- Support SOX‑relevant IT controls testing, internal audit co‑sourcing, and other compliance‑driven engagements as applicable.
- Identify control gaps, assess risk impact, and develop clear, actionable recommendations for remediation.
- Perform cybersecurity assessments and readiness reviews aligned to CMMC, NIST SP 800‑171, NIST CSF, ISO27001, and other recognized frameworks.
- Support or lead CMMC gap assessments, readiness assessments, and advisory activities for organizations in the Defense Industrial Base (DIB).
- Assist in evidence collection, validation, and analysis for cybersecurity and compliance assessments.
- Contribute to development of client deliverables, including assessment reports, risk summaries, and management presentations.
- Serve as a day‑to‑day engagement team member, managing assigned workstreams and coordinating with team members and client stakeholders.
- Simultaneously serve multiple engagements while maintaining high quality standards.
- Work with clients in a broad array of industries including information technology, financial services, retail & consumer products, pharmaceuticals, electronics, manufacturing, media, and government contracting etc.
- Facilitate client interviews and walkthroughs to understand IT environments, security controls, and operational processes.
- Ensure workpapers and deliverables meet quality, consistency, and documentation standards.
- Understand clients’ organizations and provide value‑added solutions and best practices.
- Identify emerging risks, trends, and improvement opportunities for clients.
- Mentor and review work performed by Consultants and Analysts.
- Share knowledge and best practices related to IT audit, cybersecurity, and CMMC requirements.
- Contribute to internal methodology development, tools, and training initiatives.
Requirements
- Bachelor’s degree in Information Systems, Computer Science, Accounting, Cybersecurity, or a related field.
- 4+ years of relevant experience in IT audit, IT risk, cybersecurity, or technology advisory roles.
- Hands‑on experience performing IT audits, IT risk assessments, or cybersecurity assessments.
- Strong understanding of internal controls, risk management concepts, and common cybersecurity frameworks.
- Background and understanding of the risks and controls in technologies such as web, cloud, client/server, open systems architecture, data warehousing, and imaging.
- Proficient understanding of cloud security, Identity and Access Management, ERP, Operating Systems, Databases, and Network Infrastructure components.
- Knowledge of risk and controls related to emerging technologies such as AI, blockchain, and automation.
- Working knowledge of Cloud Security Framework, General Data Protection Requirement (GDPR), COBIT 5, ISO 27001/2, HIPAA, California Consumer Protection Act (CCPA), NIST 800-171/800-53/NIST 800-37.
- Excellent written and verbal communication skills, with the ability to explain technical concepts to non‑technical audiences.
- Ability to manage multiple priorities and work effectively in a client‑facing consulting environment.
- Participate in business development activities such as proposal writing, professional networking, and thought leadership development.
- Certified Information Systems Auditor (CISA) – strongly preferred.
- Certified CMMC Assessor (CCA) or active progress toward CMMC Assessor certification – strongly preferred.
- Additional certifications a plus.
- Experience supporting federal, government contractor, or regulated industry