IT Auditor II

About the Role

Independently execute governance, risk, and compliance activities, including internal IT audits. Assist in reviewing IT policies and standards, collaborating with stakeholders to ensure effective controls and regulatory compliance.

Responsibilities

• Assist the team lead and management with risk and control consulting for IT and business departments, ensuring understanding and fulfillment of responsibilities related to IT governance, risk, and compliance.
• Execute IT Audit Plan items assigned by the team lead and management.
• Prepare or review assigned reports of audit findings and opportunities for improvement, then communicate these to appropriate company leadership.
• Review and update assigned policies to ensure compliance with industry standards and corporate needs.
• Assist with maintaining the controls framework for measuring the organization’s controls and risk; collect metrics to report policy compliance, finding remediation, and security posture to Senior Management.
• Follow and support communication mechanisms to report results of audits, risk/controls consulting projects, and investigations to management and the Audit Committee.
• Work with compliance to ensure legal and regulatory obligations for cybersecurity and privacy are met as directed by the team lead and management.
• Perform assigned vendor risk management activities.
• Assist the team lead and management in maintaining a risk register for cyber risks affecting the business, providing reasonable assurance that risk management, control, and governance systems function as intended.
• Follow the company’s ERM approach to evaluating risks and ensure the organization’s risk posture is within risk tolerance limits.
• Assist with the coordination of external audits/reviews and gather/document assigned artifacts for external requests for attestation of security and privacy practices.
• Complete other duties as assigned.

Requirements

• Bachelor's degree, preferably in IT, Business Administration, or Accounting.
• Two to three years of external and/or internal information technology, auditing, or GRC experience.
• Certified Information Systems Auditor (CISA) and/or Chartered Property and Casualty Underwriter (CPCU) designation is desired.
• An insurance background is highly desired.

Skills

• Strong written, verbal, and presentation skills.
• Self-motivated with strong interpersonal, communication, and analytical skills.
• Strong project management capabilities.
• Understanding of financial audit principles and the Sarbanes-Oxley Act or Model Audit Rule Act.
• Familiarity with NAIC Insurance Data Security Model Law.
• Familiarity with New York DFS Cyber Security Regulations (23 NYCRR 500 and related).
• Familiarity with NIST Cyber Security Framework (NIST CSF).
• Familiarity with Service Delivery and Controls Frameworks (COBIT, NIST, ITIL).
• Familiarity with privacy regulations (e.g., GDPR, CCPA).
• Ability to effectively interface with external contacts, employees, managers, and department staff members.

Because the company’s niche is the church and related ministries market, familiarity with church operations is required. Employees must conduct themselves in a manner that aligns with this target niche.