Associate IT Auditor / Audit Security Advisor

 

 

Associate IT Auditor / Audit Security Advisor - Hybrid, Cary, North Carolina

 

We’re a leader in data and AI. Through our software and services, we inspire customers around the world to transform data into intelligence - and questions into answers.

 

If you're looking for a dynamic, fulfilling career with flexibility and a world-class employee experience, you'll find it here. We're recognized around the world for our inclusive, meaningful culture and innovative technologies by organizations like Fast Company, Forbes, Newsweek and more.

 

About the job

 

The GRC team is looking for an Associate IT Auditor / Audit Security Advisor will help conduct audits to ensure internal controls are in place that align with various regulations (which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53) as well as the policies and procedures set forth by SAS.  A secondary focus is to operate in a compliance role, assist in the risk program, and facilitating remediation of continuous improvement efforts across the business.  Our team’s function is to align our technology to our enterprise business goals while managing governance, risk management, and compliance with applicable industry and government regulations.  We additionally enable tools and processes with the goal of unifying these programs with SAS’s technological innovation and adoption.

 

As an Associate IT Auditor / Audit Security Advisor you will:  

• Assist with internal audits by:
• Benchmarking of security policies against best practices and standards, which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53.
• Creating and executing on audit test cases and managing work papers and evidence
• Developing and presenting Audit Reports
• Use the ServiceNow IRM tool to create and manage continuous monitoring indicators, build reporting dashboards, document electronic work papers, and manage audit documentation
• Perform issue remediation tasks such as analysis, documentation, follow-up and retesting in response to audit findings.
• Operate as a consultant, researching and recommending changes to enhance or streamline quality and information security procedures, including internal and external auditing.
• Review hosting, security, and audit contract terms and ensure compliance to current policies and processes.
• Help maintain the IT and security policy and process development and updates, while ensuring compliance with regulatory regulations and guidance.
• Assist in conducting Risk Assessments, including participation in risk workshops with subject matter experts where vulnerabilities and threats are discussed in association with likelihood and probability factors.
• Coordinate response to complete RFP and security questionnaires.
• Perform other duties, as assigned. 

Required Qualifications

• Bachelor's degree in Business, IT, Computer Science or related field
• 2-5 years of experience in an audit, compliance, risk or governance-related functions
• Knowledge of IT, project management, compliance or quality auditor procedures and tools (not financial/accounting)
• Auditor certification, such as CISA or CQA, or equivalent professional training
• Must have the ability to work with little supervision, escalating issues, as appropriate
• Equivalent combination of related education, training and experience may be considered in place of the above qualifications.
• You’re curious, passionate, authentic and accountable. These are our values and influence everything we do. 

Additional competencies, knowledge and skills

• Collaboration - Working cooperatively with others to help a team or work group achieve its goals.
• Communication - Conveying information and ideas clearly and concisely to individuals or groups in an engaging manner that helps them understand and retain the message; listening actively to others.
• Building Trusting Relationships - Using appropriate interpersonal styles to establish effective relationships with customers and internal partners; interacting with others in a way that promotes openness and trust and gives them confidence in one’s intentions.
• Understanding of Active Directory and access control
• Understanding of best practices for information security and data privacy
• Knowledge and experience with best practices /standards: ISO 27001, ITIL, or COBIT
• Understanding of regulatory standards:  PCI, FISMA/NIST 800-53, or IRS 1075
• Experience with a GRC System and Electronic Workpapers
• Experience with ServiceNow i