Internal Audit Manager

This is a fully remote position, open to applicants in California.

📋 Description

• Oversee IT audit projects from start to finish, which includes defining scope, conducting risk assessments, performing walkthroughs, testing controls, developing issues, and validating remediation efforts.

• Manage the SOX 404 IT general controls program for designated financial applications and infrastructure.

• Evaluate IT application controls, reports, interfaces, and system-generated data that support financial reporting.

• Conduct annual and ad-hoc segregation of duties analyses while automating the processes for extraction, normalization, and comparison.

• Audit identity and access management processes, which encompass provisioning, privileged access, and periodic access reviews.

• Analyze change and release management controls across platforms such as Git, CI/CD, Jira, and ServiceNow.

• Assess controls related to cloud infrastructure and enterprise data platforms.

• Execute cybersecurity and cloud security assessments within FICO's SaaS product environments.

• Assist in third-party risk management and the review of SOC 1/SOC 2 reports.

• Contribute to AI and model governance risk management using NIST AI RMF and ISO/IEC 42001 standards.

• Utilize data analytics and AI-assisted tools for scripted population extraction, comprehensive testing, and continuous monitoring.

• Prepare work papers and compile findings for the Chief Audit Executive and/or Senior Manager of IT Risk & Assurance.

• Act as a liaison between external auditors and internal stakeholders, facilitating scoping, walkthroughs, evidence gathering, PBC requests, and the closure of open items.

• Collaborate with IT, Engineering, Security, Finance, and business process owners.

• Suggest enhancements to FICO’s internal control framework and processes.

• Mentor and evaluate junior auditors and co-sourced resources.

• Keep leadership updated on progress, control deficiencies, and audit findings while adhering to deadlines and maintaining confidentiality.

⛳️ Requirements

• Bachelor's degree in information technology, information systems, computer science, accounting, or a related field; equivalent practical experience will also be considered.

• Approximately 3–5 years of progressive experience in IT auditing; a minimum of 3 years is recommended.

• Significant experience in managing or leading ITGC and SOX 404 testing.

• Practical experience in testing IT general and application controls within a major ERP system; Oracle is strongly preferred, with SAP, NetSuite, or similar being acceptable.

• Familiarity with cloud-based business applications, including HCM, CRM, revenue, and data warehouse platforms.

• Experience utilizing AI and automation in audit processes; familiarity with Claude is beneficial as it is used by the team.

• Understanding of identity governance and privileged access principles.

• Experience auditing cloud environments in AWS; knowledge of Azure or GCP is also relevant.

• Awareness of standards such as COSO 2013, COBIT, NIST CSF, NIST SP 800-53, ISO/IEC 27001, SOC 1, SOC 2, PCI DSS, GDPR, HIPAA, and US state privacy laws like CCPA/CPRA.

• Proficient in advanced Excel, including Power Query functionalities.

• Data manipulation and scripting skills; SQL and Python are particularly useful; knowledge of PowerShell, VBA, Power BI, Tableau, shell scripting, regular expressions, and REST APIs is advantageous.

• CISA certification obtained or actively in progress.

• Demonstrated proactive and independent thinking.

• Exceptional written and verbal communication skills.

• Comfortable collaborating across global teams and time zones in a dynamic public company setting.

🏝️ Benefits

• An inclusive culture that embodies FICO’s core values.

• Opportunities for professional development and valuable learning experiences.

• Competitive compensation, benefits, and reward programs.

• Work-life balance initiatives.

• Employee resource groups.

• Social events to foster community.

• Equal employment and advancement opportunities.