IT Audit Manager, Corporate Technology & Cybersecurity

The IT Audit Manager for Corporate Technology and Cybersecurity leads complex, risk-based technology and cybersecurity audit engagements from annual planning through final reporting. This role serves as a senior audit point of contact for client leadership and communicates findings and conclusions to senior management, internal stakeholders, and examination audiences.

Key Responsibilities

• Lead executive-level discussions with technology, security, risk, finance, and business leaders, including the CTO, CISO, CRO, and their direct reports.
• Set expectations, resolve disagreements constructively, and communicate significant risks and audit conclusions.
• Define audit objectives, risk assessment approach, scope, criteria, resource plan, and timing.
• Test scope coverage against the audit universe, enterprise architecture, regulations, prior findings, emerging technology, and related dependencies to support complete coverage and defensible exclusions.
• Direct audits across technology and cybersecurity programs included within the audit profile.
• Apply deep technical audit judgment or coordinate qualified subject-matter expertise when specialized areas require additional support.
• Ensure audit scope evaluates security-asset configuration and operating effectiveness across baselines and rules/settings, privileged access, logging and monitoring, encryption, certificate lifecycle, changes, and exceptions.
• Direct and challenge configuration-focused audit coverage for assigned specialties, including identity and privileged access, network security and segmentation, cloud security architecture and WAF, Security Operations monitoring and response, vulnerability management, and data-protection controls such as DLP, encryption, and key management.
• Oversee audit planning and execution by reviewing plans, walkthroughs, sampling, procedures, evidence, workpapers, issue evaluations, and reporting for quality and supportability.
• Own engagement decisions, issue severity and root cause assessments, action plans, and resulting reports.
• Escalate promptly and resolve differences while preserving Internal Audit independence.
• Present audit plans, status, results, and significant risks to Internal Audit leadership, executives, regulators, and examiners, including ensuring examination materials are complete and supportable.
• Coordinate with assurance teams and external auditors on reliance while protecting Internal Audit scope and conclusions.
• Coach auditors, build technical capability, manage concurrent-project resourcing and deadlines, and improve audit methods, continuous auditing, and analytics.

Required Qualifications

• At least 8 years of relevant experience, including leading complex IT or cybersecurity audits and advising on technology risks and controls.
• Experience leading operational cybersecurity or data-risk audits.
• Demonstrated experience managing teams and engaging senior client leadership.
• Extensive IT/cybersecurity audit leadership across one or more domains, including: Cyber Threat Intelligence (CTI)/threat hunting; Security Operations/incident response; endpoint/network security; data security/protection/privacy; insider risk/digital forensics; Offensive Security/penetration testing/application security; vulnerability/patch management; identity and access management; cloud security/service management (AWS, Microsoft Azure, Google Cloud Platform); PKI/certificate management; or network/technology.
• Ability to assess scope completeness and direct related work.
• Hands-on security-configuration audit experience with firewalls, SIEM, cloud security, WAF, encryption, or certificates.
• Primary leadership depth in at least one complementary area: (1) IAM/PAM and identity architecture including CyberArk and Active Directory; network security including firewalls and segmentation; or cloud security architecture and WAF; or (2) Security Operations including monitoring and incident response; vulnerability management; or Data Protection including DLP, encryption, key management, and data controls.
• Experience with comparable tools is acceptable.
• Familiarity with official security guidance for Microsoft Azure, AWS, and Google Cloud, including Azure network security best practices, the AWS Well-Architected Security Pillar, and Google Cloud Well-Architected security guidance.
• Ability to apply relevant guidance when evaluating audit scope, architecture, control design, and operating effectiveness.
• Advanced understanding of risk assessment, internal control design and operating effectiveness, audit evidence, sampling, issue development, and accepted internal audit standards.
• Strong executive presence, negotiation, writing, presentation, and relationship-building skills, with sound judgment in sensitive or high-pressure discussions.

Technical and Tooling Exposure

• CyberArk, Active Directory
• SIEM, WAF
• AWS, Microsoft Azure, Google Cloud Platform
• Cyber Threat Intelligence (CTI)
• Power BI, ServiceNow, Jira
• SailPoint, AuditBoard
• DLP
• PKI/certificate management
• Azure Well-Architected security guidance, AWS Well-Architected Security Pillar, Google Cloud Well-Architected security guidance

Preferred Qualifications

• CISA or equivalent (CISM, CISSP, CRISC, CIPP/US) strongly preferred.
• Banking IT audit and regulatory examination experience preferred.
• Relevant IT or cybersecurity coursework, professional training, or hands-on experience valued.
• Familiarity with AuditBoard, Power BI, ServiceNow, Jira, or SailPoint helpful.

Location and Work Model

Santa Ana, CA (hybrid)

Compensation

USD 129,300 - 172,300 per year

Benefits

• Medical, dental, vision
• 401k
• PTO/paid sick leave
• Employee stock purchase plan