Director, Internal Audit (Emerging Technology & Infrastructure)

Company Description

Opportunity is not evenly distributed. Shopify puts independence within reach for anyone with a dream to start a business. Since 2006, we’ve grown to over 10,000 employees and generated over $500 billion in sales for millions of merchants in 175 countries. Every 28 seconds, an entrepreneur on Shopify makes their first sale.

This is life-defining work that directly impacts people’s lives as much as it transforms your own. This is putting the power of the few in the hands of the many, is a future with more voices rather than fewer, and is creating more choices instead of an elite option.

Moving at our pace brings a lot of change, complexity, and ambiguity—and a little bit of chaos. Shopifolk thrive on that and are comfortable being uncomfortable. That means Shopify is not the right place for everyone.

Before you apply, consider if you can:

• Care deeply about what you do and about making commerce better for everyone
• Excel by seeking professional and personal hypergrowth
• Keep up with an unrelenting pace (the week, not the quarter)
• Be resilient and resourceful in face of ambiguity and thrive on (rather than endure) change
• Bring critical thought and opinion — and embrace differences and disagreement to get shit done and move forward
• Work digital-first for your daily work

Job Description

We are looking to add a Director, Internal Audit (Emerging Technology & Infrastructure ) to our risk and internal audit team (remote). This role will lead a team of risk and internal audit professionals to assess various technology-related risks, including those associated with artificial intelligence, machine learning, infrastructure, security, privacy, and application risk, which are critical to Shopify's business. The role will be responsible for continuing to build on the vision for an highly agile integrated Risk and Internal Audit function by developing tools, and fostering collaborative processes related to areas of technology risk.

This position will report into the Global Head of Risk and Internal Audit and will oversee a team of individuals through project based work. They will work closely with stakeholders across the business to support Risk and Internal Audit’s role of providing objective insights into the health of risk management practices at Shopify. 

Responsibilities:

• Understanding, assessing, and contextualizing risk and efficiency and effectiveness of risk mitigation activities across Shopify’s technology environment.
• Working collaboratively with stakeholders to contextualize residual risk exposure and potential path towards mitigation inline with Shopify’s risk tolerance.
• Understanding emerging technology trends, ensuring that they are effectively contextualized and incorporated into methodology and internal audit plans.
• Contributing to a highly engaged/high performing remote team culture.
• Partner with stakeholders to synthesize key messaging and ensure that communications are tailored to focused on actions that may be required of different stakeholder groups
• Managing a team of resources to successfully deliver risk insights via project execution.

Projects you could work on: 

• Risk Management Analysis: Gather and examine data on technology risk in areas such as artificial intelligence and machine learning to offer perspectives on the efficacy of current risk management strategies and identify areas where further investments or changes in approach might be required.
• Pre-Launch Evaluations: Conduct reviews prior to the launch of significant infrastructure investments to ensure they meet necessary standards and requirements, including SOX compliance risk if infrastructure is associated with financial reporting.
• Advisory Role in Technology Controls: Act as a consultant, providing valuable insights to management on the implementation of security and privacy controls to safeguard the organization's information and systems.
• Security/Privacy Audits: Carry out audits or reviews of critical areas related to security, and privacy to manage risk effectively and ensure compliance with relevant regulations and standards.

Qualifications

Relevant experience for the role: 

• Minimum 15 years of experience in technology strategy and cybersecurity, including hands-on experience in areas such as:
  • Technology infrastructure, network and operating systems
  • Software development or API coding experience
  • Machine Learning and Large Language Models
  • Agile, DevSecOps, CI/CD
  • Major cloud platforms
  • Security threat landscape and regulatory requirements
• Senior-level experience in a risk, consulting or internal audit or related role assessing ef