Job Description
Senior Audit Manager, IT and Security
The GitLab DevOps platform empowers 100,000+ organizations to deliver software faster and more efficiently. We are one of the world’s largest all-remote companies with 1,600+ team members and values that guide a culture where people embrace the belief that everyone can contribute.
The Senior Audit Manager, IT and Security shall oversee, perform and execute the annual internal audit plan of Information Technology (IT) and Information Security (InfoSec) audits.
This responsibility includes assessing risk, developing audit scopes, performing audit procedures, and preparing internal audit reports reflecting the results of the work performed and reviewing the work of audit staff.
The Senior Audit Manager, IT and Security will interact heavily with the IT/InfoSec Leadership and must be able to clearly articulate related risks and audit results to technical and non-technical members of executive management. This position reports to the Vice President of Internal Audit.
Supervisory Responsibility
This position may have supervisory responsibilities in the future and will be responsible for day-to-day management of IT Audit staff and their development of subject matter expertise.
What you’ll do in this role
- Assists in developing and maintaining the Internal Audit IT/InfoSec Risk Assessment.
- Primary function will be to plan and perform risk based/security audits in areas including, but not limited to, applications (internal & external facing), databases, operating systems, sensitive data, patch management, change management, BCP/DR, third party, cloud, etc.
- Oversees the development of IT Audit staff and ensures the execution of the annual audit plan.
- Performs SOX ITGC, regulatory or compliance audits as required.
- Interacts with external audit firms and provides guidance and support for audit engagements.
- Effectively analyzes and assesses risk to develop audit procedures, execute test procedures, and conclude on the operating effectiveness of relevant controls through the development of formal reports.
- Leverages appropriate resources for planning the audit engagement, and effectively leads interviews/meetings to ensure relevant information is obtained for analysis.
- Performs an appropriate level of testing based on the scope and risk, without over- or under-auditing.
- Produces work paper documentation that is clear and concise, provides adequate detail of work performed and conclusions reached, meets department and professional standards, and is sufficient to receive a satisfactory rating from reviewers.
- Communicates obstacles or problems as they are encountered throughout the audit.
- Identifies control issues and findings timely, and ensures findings are based on relevant facts and are accurately characterized (based on risk).
- Clearly communicates control findings to Internal Audit Management as they are identified.
- Shares Internal Audit processes and business area knowledge with team members.
- Maintaining appropriate industry associations to keep up to date with emerging technologies/IT risks and identify/leverage audit best practices.
- Ensures the Internal Audit team is advised of key developments in all areas of responsibility.
- Working with external auditors to coordinate IT coverage across areas of responsibility and ensure that audit work is comprehensive and sufficient to allow the external auditors to rely on the work.
- Challenges the status-quo’ and brings original ideas to the team.
- Fosters a team environment, is inclusive and works well with others.
- Prepares monthly reporting for the Executive team summarizing activities and key performance indicators.
- Other tasks as assigned.
We’re looking for
- Bachelor’s degree in related field required (e.g., Computer Science, Management Information Systems, Accounting)
- CISA, CISSP, CISM, or other relevant certification is required.
- 9+ years of internal and/or external IT audit experience required.
- Mix of operational and IT audit experience desired.
- Experience as project lead including:
- Risk Assessment
- Planning
- Audit execution
- Issue/report writing
- Business risk awareness and appropriate judgment to use a risk-based approach while executing the audits.
- High level of tact and ability to communicate complex and potentially sensitive issues to various levels of management both within IT functions and outside to key non-technical business personnel.
- Can conform to shifting priorities, demands and timelines through analytical and problem-solving capabilities.
- Must possess strong computer skills
- Must be able to think analytically, independently and objectively.
- Must have working knowledge of tools & technical processes including: identity & access management, database management; software development methodologies, change management, vulnerability management, penetration testing, data loss prevention, batch processing, business continuity/disaster recovery planning; enterprise architecture,security etc.
- Understanding of IT control frameworks (COBIT, ISO 27002, NIST, ITIL, FedRamp etc.) is required.
- Knowledge of SOX 302/404, SSAE 16/SOC1/2/3
- Excellent written and oral communication skills
- Ability to communicate information in an understandable form to the right parts of the organization
- Ability to work effectively in a team environment, both within Internal Audit and across other departments
- Must be able to work in US and International time zones, when required
- Ability to balance quality of work with speed of execution
- Ability to use GitLab
