Senior Technology Auditor, GA&A (1 of 2)

We need to output HTML fragment with sections: About the role? The posting includes description, responsibilities, qualifications, pay, benefits. Also maybe "Job Description" is a section heading? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Use

• for any list of duties/requirements/benefits, and

  for prose. Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

  or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. We need to decide which sections to include. The posting includes: - Intro paragraph about J&J (maybe "About the role"? Actually that's about company, not role. Could be "About the role" or "Job Description". The instruction says we can use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only when there is real content. We have: - Job Description paragraph: "Johnson & Johnson Global Audit & Assurance (GAA) organization is seeking a Senior Technology Auditor in New Brunswick, NJ. Global Audit & Assurance’s primary mission is to provide independent, objective assurance and advisory services to assist management in maintaining compliance with government and industry regulations, mitigating risk, and achieving operational excellence. The Senior Auditor will work across Johnson & Johnson's global technology environments, collaborate with teams throughout the organization to evaluate risks and internal controls related to cybersecurity, cloud, artificial intelligence, digital platforms, enterprise applications, privacy, and business transformation initiatives. This role provides broad exposure to senior leadership and opportunities to evaluate critical technology initiatives supporting one of the world's largest healthcare organizations." That could be under "About the role" or "Job Description". Since we have a heading "About the role" allowed, we can use that. - Responsibilities: a list of bullet points (though they are sentences separated by periods). We need to put them in

  • . - Qualifications: there are Required and Preferred subsections. Could combine under "Qualifications" heading, with sub-lists maybe? But we can just list all qualifications as bullet points under Qualifications. However we need to preserve required vs preferred distinction? The instruction says preserve ALL substantive information; do not invent or summarize away detail. So we should keep the distinction maybe by having two sub-sections? But we only have headings for Qualifications (no subheadings). Could we embed a

    indicating Required and Preferred? Probably we can include a

    before each list. But we must not create extra headings unless content exists. We could have a

    for "Required:" then a

    . Then another

    for "Preferred:" then a

    . That's acceptable. - Skills: The posting includes "Required Skills Preferred Skills: ..." Actually there is a line: "Required Skills Preferred Skills: Analytical Reasoning, Audit and Compliance Trends, Audit Reporting, Business Behavior, Compliance Policies, Data Analysis, Execution Focus, Financial Analysis, Financial Risk Management (FRM), Internal Auditing, Internal Controls, Issue Escalation, Leverages Information, Problem Solving, Process Oriented, Professional Ethics, Risk Assessments". That seems like a list of skills. Could be under "Skills" heading. However we already have Qualifications covering similar content. Might be redundant. The instruction says prefer a few substantive sections over many thin ones. So we could combine skills into Qualifications or maybe omit Skills section if content is covered elsewhere. But we need to preserve all substantive information; if we omit the skills list, we lose that detail. However the qualifications already list many of those skills (e.g., Analytical Reasoning, Audit and Compliance Trends, etc.) Actually the qualifications list includes things like "Strong analytical skills", "Ability to apply critical thinking", etc. The skills list is more specific. To preserve, we could include a Skills section with that list. - Pay: The posting includes "The anticipated base pay range for this position is : $79,000.00 - $127,650.00". So we need a Pay section with that info. - Benefits: There's a long list of benefits under "Benefits". So we need a Benefits section with that list. - Schedule: Not mentioned. So we should not create a Schedule section. - Also there is location info: "All Job Posting Locations: New Brunswick, New Jersey, United States of America". Could be included in a short paragraph under About the role or maybe a separate metadata paragraph. The instruction says fold minor metadata into a short

    or drop it. So we can include a

    with location. - Also there is "Job Function Finance Job Sub Function Internal Audit Job Category Professional". Could be minor metadata; we can include in a short paragraph. - Also there is "Learn more at jnj.com" etc. That's boilerplate; we should remove. - Also there is EEO statement etc; remove. - Also there is "Additional Description For Pay Transparency" maybe boilerplate; but the pay range is substantive; we keep that. - Also there is "Subject to the terms of their respective plans, employees are eligible to participate in the Company’s consolidated retirement plan (pension) and savings plan (401(k))." That's part of benefits; we should include under Benefits. - Also there is "For additional general information on Company benefits, please go to: - https://www.careers.jnj.com/employee-benefits". That's a link; maybe we keep as part of Benefits? It's a reference; could keep as a

    with link. We need to output only HTML fragment, no markdown fences. Let's structure:

    About the role

    Johnson & Johnson Global Audit & Assurance (GAA) organization is seeking a Senior Technology Auditor in New Brunswick, NJ. Global Audit & Assurance’s primary mission is to provide independent, objective assurance and advisory services to assist management in maintaining compliance with government and industry regulations, mitigating risk, and achieving operational excellence. The Senior Auditor will work across Johnson & Johnson's global technology environments, collaborate with teams throughout the organization to evaluate risks and internal controls related to cybersecurity, cloud, artificial intelligence, digital platforms, enterprise applications, privacy, and business transformation initiatives. This role provides broad exposure to senior leadership and opportunities to evaluate critical technology initiatives supporting one of the world's largest healthcare organizations.

    Location: New Brunswick, New Jersey, United States of America

    Job Function: Finance; Job Sub Function: Internal Audit; Job Category: Professional

    Then Responsibilities:

    Responsibilities

    • Perform risk-based technology audits with limited supervision, including Technology Risk-Based Reviews, pre-implementation reviews, and SOX 404 ITGC testing.
    • Lead audit workstreams by providing direction, delegating responsibilities, reviewing work, and delivering constructive feedback.
    • Plan and execute audit procedures, document assigned review areas and evaluate the design and operating effectiveness of controls across financial reporting, healthcare operations, privacy, data protection, and cybersecurity.
    • Develop timely, high-quality audit deliverables, analyses, and communications that clearly support conclusions, demonstrate professional judgment, and meet departmental quality standards.
    • Identify key risks, root causes, and business impacts to develop practical recommendations to strengthen controls and reduce technology risk.
    • Coordinate ongoing control testing in accordance with industry audit standards and J&J guidelines.
    • Build trusted relationships with global cross-functional teams and external stakeholders throughout audit engagements.
    • Leverage data analytics, automation, continuous monitoring, and AI-enabled audit techniques to deliver risk insights and enhance audit effectiveness.
    • Translate complex technical matters into clear business risks, executive-level insights, and actionable recommendations for technical and non-technical audiences.
    • Track remediation of audit findings and validate the adequacy and sustainability of management corrective actions.
    • Maintain awareness of relevant laws, regulations, industry standards, and emerging technology risks, including cloud, artificial intelligence, data governance, major system implementations, cybersecurity, privacy, and third-party dependencies.
    Qualifications: We need Required and Preferred.

    Qualifications

    Required:

    • Bachelor’s degree (IT, Computer Science, Data Science, Accounting, or related field preferred).
    • Minimum of 3 years of professional experience in information technology, audit, assurance or advisory services, preferably within a multinational company, Big 4 firm, leading risk advisory firms or public accounting organization.
    • Demonstrated ability to independently execute audit procedures, assess risk, evaluate controls and communicate recommendations to management.
    • Strong working knowledge of technology risk, cybersecurity, and information security frameworks and control concepts (e.g., NIST, COBIT, ISO)
    • Strong analytical skills with a risk‑and‑control mindset.
    • Ability to apply critical thinking and professional judgement to identify emerging risks and assess complex technology environments.
    • Demonstrated ability to build trusted relationships, influence stakeholders, collaborate across teams and levels of management, and effectively lead audit workstreams and projects.
    • Excellent presentation and written communication skills.
    • Ability to work in a highly collaborative, team‑oriented environment.
    • Demonstrated curiosity and commitment to continuous learning in emerging technology, cybersecurity, artificial intelligence and digital risk domains.
    • Ability to travel domestically and internationally (up to 40%).

    Preferred:

    • Experience in cybersecurity, cloud technologies, privacy, AI & data governance, supply chain/third‑party risk, and technology controls.
    • Proficiency/experience in Tech Risk Frameworks (e.g., COBIT, NIST, ISO)
    • Familiarity with data analytic tools and knowledge of agile development, and emerging technologies (e.g., AI/ML, RPA).
    • Experience with SAP HANA.
    • Exposure and understanding of internal control concepts and processes with practical experience in regulatory compliance, internal audits, risk management, and process improvement.
    • Professional security, audit, or control‑related certification, such as CISSP, CISA, CRISC, or CIA.
    Skills: The list of skills. We could include a Skills section:

    Skills

    • Analytical Reasoning
    • Audit and Compliance Trends
    • Audit Reporting
    • Business Behavior
    • Compliance Policies
    • Data Analysis
    • Execution Focus
    • Financial Analysis
    • Financial Risk Management (FRM)
    • Internal Auditing
    • Internal Controls
    • Issue Escalation
    • Leverages Information
    • Problem Solving
    • Process Oriented
    • Professional Ethics
    • Risk Assessments
    Pay:

    Pay

    The anticipated base pay range for this position is $79,000.00 - $1