Senior IT Auditor

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. Must not include Job ID etc. Must preserve all substantive info, no summarizing away detail. Must remove boilerplate like EEO, legal, application instructions, etc. Must not include sections with filler like "commensurate with experience". Must only include sections where posting has real specific content. Let's parse the posting. Content: - Senior IT Auditor responsibilities: planning, executing, reporting on operational IT audits, evaluating risks and controls, including application, infrastructure, cloud, data management, SDLC, change management, IT operations, per IIA standards and department methodologies. Perform IT SOX control walkthroughs and testing, preparing documentation. Assess effectiveness of cybersecurity controls, including identity and access management, vulnerability management, logging and monitoring, incident response, security governance. Typical day might include: Review controls related to cloud computing (e.g., AWS, Azure), SaaS platforms, data lakes, analytics environments, including shared responsibility models. Design and execute data analytics-driven audit procedures using tools such as Dataiku or equivalent, to identify anomalies, trends, control gaps. Apply automation, continuous auditing techniques, responsible use of AI, where appropriate, to improve audit efficiency, coverage, insight, including assessing AI-enabled business processes and controls. Manage timely completion of audit tasks, including communication of status to auditee and Manager/Director. Identify, document, and communicate control deficiencies, root causes, technology risks, opportunities for improvement, providing practical, actionable recommendations aligned with business objectives. Present results of audit work to Internal Audit Management and auditees, including practical recommendations to address identified risks and/or weaknesses in internal controls as well as opportunities to enhance operational efficiencies. Prepare clear, concise, professional audit reports and executive-level presentations for Internal Audit leadership, management, key stakeholders. - This role might be for you if have experience with: Advanced knowledge of IT infrastructure, applications, cybersecurity, and automated controls. Strong understanding of SOX, COSO, COBIT, NIST, GxP, GDPR, and other relevant regulatory and governance frameworks. Strong analytical, critical thinking, problem solving skills, with ability to independently assess risk and propose solutions. Comfortable working and learning independently and as part of a team. Excellent interpersonal, communication and writing skills, strong organizational abilities, and attention to detail are required. Experience with data analytical tools (e.g. Dataiku, Alteryx, etc.). Understanding of AI concepts, associated risks (e.g., model governance, data quality, access, ethical use), and internal controls relevant to AI-enabled processes. - To be considered for this role, you must have a Bachelor's degree with a minimum of 3 - 4 years of progressive experience in IT audit, information security, or technology risk. CISA, CISM and/or CISSP certifications/license preferred. Experience auditing and evaluating infrastructure, cybersecurity risks/controls and auditing operating systems. Pharmaceutical, life sciences, or other regulated industry experience strongly preferred. Big 4 or public accounting experience preferred but not required. - Does this sound like you? Apply now... (application instruction, remove). Then EEO boilerplate (remove). Then "We are committed to building a workplace with an inclusive culture..." (EEO). Remove. Then "Where required, we will provide reasonable accommodation..." (EEO). Remove. Then "Where necessary, we disclose salary ranges for roles in all countries..." (Pay info). Then "Regeneron offers a competitive and comprehensive total rewards package which may include, depending on country and role: annual bonuses or other incentive plans, equity awards, pension or retirement benefits, 401(k) company match, health and wellness programs, fitness centers, insurance benefits (e.g. medical, dental, vision, life and disability), paid time off, and family support benefits." That's benefits. Then "For additional information about Regeneron benefits in the U.S., please visit ..." (link). Remove? It's application instruction? Might be considered extra but it's about benefits info; but it's a link. Probably we can keep benefits section but not the link? The instruction says remove application instructions. The link is not exactly application instruction but it's a reference. Might be okay to keep but it's not essential. Safer to omit the link as it's not substantive content? It's a pointer for more info; but we can keep benefits description. - Then "If you have any questions, please speak with your recruiter." (application instruction) remove. - "Please be advised that at Regeneron, we believe we do our best work when we are together. For that reason, many roles are required to be performed onsite. Please speak with your recruiter and hiring manager for more information about onsite expectations for your role and location." That's schedule info (onsite expectations). So we have schedule content: many roles required to be performed onsite. So we can include Schedule section with that statement. - "As part of the recruitment process, certain background checks may be conducted..." (application instruction/boilerplate) remove. - "For jobs in Canada: this posting is for an existing position. Salary Range (annually) $93,900.00 - $153,300.00" That's pay info specific to Canada. So we have Pay section with salary range. Thus we have sections: - About the role: maybe a brief paragraph summarizing role? The posting starts with "The Senior IT Auditor is responsible for contributing towards planning, executing, and reporting on operational IT audits..." That's essentially about the role. We can put that as About the role. - Responsibilities: list of duties (the bullet-like sentences). We can extract responsibilities as list items. - Requirements: maybe the "To be considered for this role, you must have..." includes education, experience, certifications, industry experience, etc. That's qualifications/requirements. - Qualifications: maybe overlapping with requirements; but we can combine? The instruction says prefer few substantive sections over many thin ones. We could have About the role, Responsibilities, Requirements (which includes education, experience, certifications, preferred qualifications), Skills (maybe technical skills), Benefits, Pay, Schedule. But we need to avoid duplication. Let's decide: - About the role: short paragraph describing role purpose. - Responsibilities: list of duties (the detailed tasks). - Requirements: education, experience, certifications, preferred experience (pharma, Big 4). Could also include "Strong understanding of SOX, COSO, etc." but that's more knowledge/skills. Might fit under Skills. - Skills: list of knowledge/skills: advanced knowledge of IT infrastructure, applications, cybersecurity, automated controls; strong understanding of frameworks; analytical, critical thinking, problem solving; interpersonal/communication/writing; organizational; attention to detail; experience with data analytical tools; understanding of AI concepts and risks; etc. - Benefits: description of total rewards package. - Pay: salary range for Canada (maybe also mention that final offer determined within range based on country, role level, skills/experience; collective bargaining agreements may apply). We'll include that. - Schedule: onsite expectation statement. We must not include sections with filler like "commensurate with experience". We have specific content. Now we need to output HTML fragment only, using

for section headings,

• for any list of duties/requirements/benefits, and

  for prose. We must not repeat job title as heading. So no

  Senior IT Auditor

  . We must not put Job ID/requisition numbers as headings. We must preserve ALL substantive information; do not invent or summarize away detail. So we need to keep details like specific tools (Dataiku, Alteryx), frameworks (SOX, COSO, COBIT, NIST, GxP, GDPR), etc. We must not include boilerplate like EEO, legal, application instructions. We must not include duplicated lines. Let's extract substantive content precisely. First, About the role: The first sentence: "The Senior IT Auditor is responsible for contributing towards planning, executing, and reporting on operational IT audits, evaluating risks and controls, including application, infrastructure, cloud, data management, SDLC, change management, and IT operations, in accordance with IIA standards and department methodologies." That's a good summary. Could also add "Perform IT SOX control walkthroughs and testing, along with preparing the related documentation. Assess the effectiveness of cybersecurity controls, including identity and access management, vulnerability management, logging and monitoring, incident response, and security governance." But those are responsibilities. So About the role can be just that first sentence. Now Responsibilities: list items: - Review controls related to cloud computing (e.g., AWS, Azure), SaaS platforms, data lakes, and analytics environments, including shared responsibility models. - Design and execute data analytics-driven audit procedures using tools such as Dataiku or equivalent, to identify anomalies, trends, and control gaps. - Apply automation, continuous auditing techniques, and responsible use of AI, where appropriate, to improve audit efficiency, coverage, and insight, including assessing AI-enabled business processes and controls. - Manage timely completion of audit tasks, including communication of status to the auditee and the Manager/Director. - Identify, document, and communicate control deficiencies, root causes, technology risks, and opportunities for improvement, providing practical, actionable recommendations aligned with business objectives. - Present the results of audit work to Internal Audit Management and auditees, including practical recommendations to address identified risks and/or weaknesses in internal controls as well as opportunities to enhance operational efficiencies. - Prepare clear, concise, and professional audit reports and executive-level presentations for Internal Audit leadership, management, and key stakeholders. Also earlier tasks: "Perform IT SOX control walkthroughs and testing, along with preparing the related documentation." and "Assess the effectiveness of cybersecurity controls, including identity and access management, vulnerability management, logging and monitoring, incident response, and security governance." Those are also responsibilities. Should we include them? Yes, they are substantive. So add: - Perform IT SOX control walkthroughs and testing, and prepare related documentation. - Assess the effectiveness of cybersecurity controls, including identity and access management, vulnerability management, logging and monitoring, incident response, and security governance. We could combine with earlier list. Now Requirements: Education/experience/certifications/preferred experience. - Bachelor's degree with a minimum of 3 - 4 years of progressive experience in IT audit, information security, or technology risk. - CISA, CISM and/or CISSP certifications/license preferred. - Experience auditing and evaluating infrastructure, cybersecurity risks/controls and auditing operating systems. - Pharmaceutical, life sciences, or other regulated industry experience strongly preferred. - Big 4 or public accounting experience preferred but not required. Also maybe "To be considered for this role, you must have a Bachelor's degree..." That's the requirement. Now Skills: list of knowledge/skills: - Advanced knowledge of IT infrastructure, applications, cybersecurity, and automated controls. - Strong understanding of SOX, COSO, COBIT, NIST, GxP, GDPR, and other relevant regulatory and governance frameworks. - Strong analytical, critical thinking, and problem solving skills, with the ability to independently assess risk and propose solutions. - Comfortable working and learning independently and as part of a team. - Excellent interpersonal, communication and writing skills, strong organizational abilities, and attention to detail are required. - Experience with data analytical tools (e.g. Dataiku, Alteryx, etc.). - Understanding of AI concepts, associated risks (e.g., model governance, data quality, access, ethical use), and internal controls relevant to AI-enabled processes. Now Benefits: description: - Regeneron offers a competitive and comprehensive total rewards package which may include, depending on country and role: annual bonuses or other incentive plans, equity awards, pension or retirement benefits, 401(k) company match, health and wellness programs, fitness centers, insurance benefits (e.g. medical, dental, vision, life and disability), paid time off, and family support benefits. We could also mention that further info available via link but we can omit link as