Risk Cyber Internal Audit Senior Associate
Grant Thornton (US) · Edison, NJ · 1 mo ago
Hybrid$101k–$129k/yrFull-time
We need to output HTML fragment with sections: headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. Remove boilerplate, navigation, legal, EEO, etc. Preserve all substantive info.
We need to parse job description.
Key sections:
- About the role: description of role, day-to-day tasks. Could be "About the role" heading.
- Responsibilities: list of duties (the bullet points after "Your day-to-day may include:" and later tasks). Could be a list.
- Requirements: maybe "You have the following technical skills and qualifications:" includes education, experience, certifications, etc. Could be "Requirements" or "Qualifications". We need to decide.
- Skills: maybe list of technical skills and frameworks.
- Benefits: there is a Benefits section later with description and link. Also mention discretionary annual bonus etc. So we can include Benefits.
- Pay: base salary range given: $101,200 to $129,030. So include Pay.
- Schedule: mention hybrid work model: in-person attendance at least three days per week, either at GT office or client site. Also mention flexible schedule, work-life integration. So we can include Schedule.
We must not repeat job title as heading. No Job ID.
We must not include boilerplate like EEO, legal, etc. Remove "About Us", "About The Team", maybe we can incorporate some of that into About the role or Benefits? But "About Us" is boilerplate about firm; we can drop as not specific to role? The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "About Us" and "About The Team" might be considered boilerplate but they contain some info about hybrid work model etc. However we already capture schedule from that. The "About Us" paragraph about firm's services etc is generic; we can drop. The "About The Team" includes info about work location, schedule, benefits, inclusion etc. Some of that is relevant to schedule and benefits. We'll extract schedule and benefits from there, but we can drop the rest.
We must not invent or summarize away detail. Must preserve all substantive information. So we need to keep details like frameworks list, responsibilities bullet points, etc.
We need to output only HTML fragment, no /, no markdown fences.
We'll structure:
.
Let's extract those sentences:
- Assist in planning and executing Cybersecurity internal audits, risk assessments, and control testing engagements.
- Lead walkthroughs, interviews, and workshops with client stakeholders to understand security processes and technology environments.
- Perform Cybersecurity control testing and Cybersecurity program capability assessments.
- Conduct Cybersecurity maturity assessments using frameworks such as NIST CSF, CSA CCM, ISO/IEC 27001, COBIT, and HITRUST.
- Support assessments for regulatory compliance including HIPAA, FedRAMP, GLBA, GDPR, and state-led data breach notification laws.
- Document process, risk and control improvement considerations, develop risk-based recommendations, and develop client deliverables.
- Identify emerging technology risks (i.e., AI, Cloud, Quantum-computing risks), deep-dive into AI model risks, supply-chain risks, document control deficiencies and develop risk mitigation strategies.
- Develop roadmaps to help clients mitigate Cyber risks and enhance overall Cybersecurity posture.
- Stay current on Cybersecurity trends, threat landscapes, and regulatory developments. This includes technical familiarity with common Cybersecurity tools, cloud environment/architecture, and threat vectors.
- Provide mentorship and training to junior team members by reviewing their work, offering guidance on risk assessment methodologies, and supporting their professional development to enhance overall team capability.
- Contribute to project management tasks such as scheduling, documentation, and status reporting to ensure smooth execution of projects.
- Support client engagements from start to finish, which includes planning, fieldwork (including control testing), and reporting.
- Participate in professional development activities and training sessions on regular basis.
- Assist with business development initiatives, including proposal preparation, research, and developing client presentations.
- Adhere to the highest degree of professional standards and strict client confidentiality.
- Other job duties as assigned.
We'll keep all.
Requirements: education and experience etc.
From "You have the following technical skills and qualifications:" Actually that heading includes both qualifications and skills. But we can split.
Education/experience:
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field is required.
- Master’s degree in Cybersecurity related field preferred (not required)
- 3+ years of experience in Cybersecurity, internal audit, or IT risk.
- CISA, CISSP or similar professional certifications (CISA, and CISSP) preferred.
- Experience as a client serving professional for a consulting firm desired.
We'll put these under Requirements.
Skills: technical skills and frameworks list:
- Familiarity with Cybersecurity frameworks and standards including (but not limited to):
NIST CSF, NIST 800-53, NIST 800-171
NIST AI RMF
CSA CCM
ISO/IEC 27001, ISO/IEC 27002
HIPAA, FedRAMP, GLBA, CCM
COBIT, HITRUST, PCI DSS
- Functional understanding of IT, Cybersecurity, AI, cloud security, data protection, vulnerability management, and incident response.
- Strong understanding of the cloud shared responsibility model and how that may impact clients.
- Ability to communicate clearly and effectively (oral and written) with all internal and external stakeholders.
- Ability to deliver presentations to clients on Cybersecurity risk assessments, findings, and recommendations
- Strong project management skills and the ability to execute multiple engagements and competing priorities in a rapidly growing, fast-paced, interactive, results-based team environment.
- Ability to travel to client locations (as needed).
We'll put these under Skills.
Benefits: from Benefits section: "We understand that your needs, responsibilities and experiences are different, and we think that’s a good thing. That’s why we support you with personalized and comprehensive benefits that recognize and empower all the identities, roles and aspirations that make you, well, you. For an overview of our benefit offerings, please visit: https://www.grantthornton.com/careers/rewards-and-benefits Benefits for internship positions: ... Benefits for seasonal employee positions: ... Grant Thornton employees may be eligible for a discretionary, annual bonus based on individual and firm performance, subject to the terms, conditions and eligibility criteria of the applicable bonus plan or program. Interns and seasonal employees are not eligible for bonus compensation."
We need to preserve all substantive info. So we can summarize benefits as: personalized and comprehensive benefits; overview link; internship benefits: medical, dental, vision insurance, employee assistance program, minimum 72 hours paid sick leave, paid for firm holidays within internship period; seasonal employees: same insurance, EAP, may be eligible for 401(k) savings plan and employee retirement plan per plan terms, minimum 72 hours paid sick leave; employees may be eligible for discretionary annual bonus; interns/seasonal not eligible for bonus.
We'll keep that.
Pay: base salary range $101,200 to $129,030. Also note placement discretion etc. We'll keep that.
Schedule: hybrid work model: consistent with firm's hybrid work model, this position will require in-person attendance at least three days per week, either at a GT office or client site. Also mention work-life integration options, flexible schedule, prioritize overall well-being. We'll include that.
Now produce HTML.
We must not include any markdown fences. Just raw HTML.
We'll produce:
.
We'll copy the sentences exactly.
Requirements list:
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field is required.
- Master’s degree in Cybersecurity related field preferred (not required)
- 3+ years of experience in Cybersecurity, internal audit, or IT risk.
- CISA, CISSP or similar professional certifications (CISA, and CISSP) preferred.
- Experience as a client serving professional for a consulting firm desired.
Skills list: we need to preserve the list items.
We'll break into items:
- Familiarity with Cybersecurity frameworks and standards including (but not limited to): NIST CSF, NIST 800-53, N
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. Remove boilerplate, navigation, legal, EEO, etc. Preserve all substantive info.
We need to parse job description.
Key sections:
- About the role: description of role, day-to-day tasks. Could be "About the role" heading.
- Responsibilities: list of duties (the bullet points after "Your day-to-day may include:" and later tasks). Could be a list.
- Requirements: maybe "You have the following technical skills and qualifications:" includes education, experience, certifications, etc. Could be "Requirements" or "Qualifications". We need to decide.
- Skills: maybe list of technical skills and frameworks.
- Benefits: there is a Benefits section later with description and link. Also mention discretionary annual bonus etc. So we can include Benefits.
- Pay: base salary range given: $101,200 to $129,030. So include Pay.
- Schedule: mention hybrid work model: in-person attendance at least three days per week, either at GT office or client site. Also mention flexible schedule, work-life integration. So we can include Schedule.
We must not repeat job title as heading. No Job ID.
We must not include boilerplate like EEO, legal, etc. Remove "About Us", "About The Team", maybe we can incorporate some of that into About the role or Benefits? But "About Us" is boilerplate about firm; we can drop as not specific to role? The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "About Us" and "About The Team" might be considered boilerplate but they contain some info about hybrid work model etc. However we already capture schedule from that. The "About Us" paragraph about firm's services etc is generic; we can drop. The "About The Team" includes info about work location, schedule, benefits, inclusion etc. Some of that is relevant to schedule and benefits. We'll extract schedule and benefits from there, but we can drop the rest.
We must not invent or summarize away detail. Must preserve all substantive information. So we need to keep details like frameworks list, responsibilities bullet points, etc.
We need to output only HTML fragment, no /, no markdown fences.
We'll structure:
About the role
... description ...
Responsibilities
- ... ...
Requirements
- ... ...
Qualifications
maybe. But instruction: use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can choose which are appropriate. We have content for: About the role, Responsibilities, Requirements (education/experience), Skills (technical skills/frameworks), Benefits, Pay, Schedule. We'll not include Qualifications if we already have Requirements. Let's extract: About the role: first paragraph(s) before "Your day-to-day may include:" maybe up to that. Original: "Job Description As a member of Grant Thornton’s Cybersecurity Internal Audit (IA Cybersecurity) team, you will have the opportunity to collaborate with our clients and deliver consulting and advisory services across a broad spectrum of areas related to cybersecurity. You will support clients in evaluating and enhancing their Cybersecurity risk posture through internal audits, control testing, and maturity assessments. You’ll work closely with cross-functional across risk and compliance teams to assess risks, test controls, and provide actionable insights aligned with industry standards and regulatory frameworks. As an IA Cybersecurity Senior Risk Associate, you will get the opportunity to contribute to our clients' business needs and grow within our practice by applying a collection of Cybersecurity capabilities, including governance, risk assessments, control testing, and technology operations for the Cybersecurity practice, all with the resources, environment, and support to help you excel. From day one, you’ll be empowered by the greater Cyber & Risk Advisory team to help clients make the moves that will help them achieve their vision and help you grow your Cybersecurity knowledge." We can keep that as About the role. Responsibilities: list after "Your day-to-day may include:" up to before "You have the following technical skills and qualifications:" includes many bullet-like sentences separated by periods. We'll convert each sentence toAbout the role
...
Responsibilities
- ...
Requirements
- ...
Skills
- ...
Benefits
...
Pay
...
Schedule
...
Make sure to not duplicate content. Let's craft each. About the role paragraph: combine the sentences. We'll write:As a member of Grant Thornton’s Cybersecurity Internal Audit (IA Cybersecurity) team, you will collaborate with clients to deliver consulting and advisory services across a broad spectrum of cybersecurity areas. You will support clients in evaluating and enhancing their cybersecurity risk posture through internal audits, control testing, and maturity assessments, working closely with cross‑functional risk and compliance teams to assess risks, test controls, and provide actionable insights aligned with industry standards and regulatory frameworks. As an IA Cybersecurity Senior Risk Associate, you will contribute to clients’ business needs and grow within the practice by applying cybersecurity capabilities such as governance, risk assessments, control testing, and technology operations, with the resources, environment, and support to excel. From day one, you’ll be empowered by the greater Cyber & Risk Advisory team to help clients achieve their vision while growing your cybersecurity knowledge.
That preserves substance. Responsibilities list: each bullet as