Sr IT Auditor I

Job Summary: 

The Senior IT Auditor position will provide internal audit and advisory services focused on the design and effectiveness of governance, risk management, and control activities supporting CSX’s information systems and technologies. This includes providing assurance over key risk areas such as cybersecurity, system implementations (including cloud migration), core IT processes and IT general controls (ITGCs) supporting SOX compliance. There will also be opportunities to participate in initiatives to improve departmental and company-wide systems and processes.

Primary Activities and Responsibilities:

• Perform pre-audit research and define risk-based scope, objectives, and audit procedures for assigned audits
• Conduct interviews, gather and evaluate appropriate audit evidence, perform analysis, and document appropriate information to support conclusions. Utilize data and technology tools, where appropriate, to enhance efficiency, coverage, and value of audit activities. Manage self and others to meet project objectives, budget and timelines while adhering to departmental and IIA standards for quality
• Identify, document, and prioritize issues and provide insights to management to aid in the development of corrective action plans
• Draft formal reports and memos to communicate observations and related action plans to department leaders and executives
• Perform follow-up inquiries and validation related to prior audit issues to ensure management is taking timely and appropriate corrective action
• Assist other internal audit teams with identifying significant IT risks within the scope of other compliance, financial, or operational audits including developing audit procedures and reviewing related audit documentation
• Support annual SOX program by performing ITGC walkthroughs, designing and executing control tests, and reviewing testing performed by others
• Participate in cross-functional teams and initiatives to continuously improve departmental and company systems and processes
• Maintain appropriate professional and ethical standards and certifications. Attend training and share knowledge on relevant IT topics

Minimum Qualifications:

• Bachelor’s degree from an accredited institution in a Technology or Business-related field
• Three or more years work experience in auditing, business/IT consulting, accounting, information systems/technology, risk management, or a related area
• Interest in pursuing one or more relevant professional certifications:  IT audit (CISA), Information Security (e.g. CISM, CISSP, Security+, etc.) IT Governance and Risk Management (CGEIT, CRISC) 

Preferred Qualifications:

• Master’s degree from an accredited institution in business administration, accounting, information systems/technology, or computer science                   
• Three or more years of experience in IT auditing at large public company or assurance/consulting firm
• Two or more years of experience in large-scale ERP implementation, cloud migration, or conversion/modernization of legacy systems
• One or more relevant professional certifications: IS Audit (CISA), Information Security (e.g. CISM, CISSP, Security+, etc.), IT Governance & Risk Management (CGEIT, CRISC)
• Technical proficiency in ACL / Diligent HighBond and Microsoft O365

Knowledge and Skills:

• Knowledge of common enterprise Technology platforms from legacy mainframe and to modern distributed and cloud environments
• Knowledge and skill in applying IT audit, governance, risk, and control concepts as well as common frameworks (COBIT, NIST CSF, NIST 800-53, CIS CSC, SOC/TSC 100, etc.)
• Knowledge of common cloud computing platforms and related risks (SaaS, PaaS, IaaS)
• Knowledge of significant technology processes and general controls
• Knowledge of tools and techniques to extract, normalize, and analyze complex data (e.g. SQL, ACL Analytics, Alteryx, Tableau, etc.)
• Skill in personal planning and project management including ability to maintain composure under pressure while meeting multiple deadlines
• Skill in effective verbal and written communications including active listening skills and skill in presenting findings and recommendations
• Skill in negotiating issues and resolving problems
<