Description & RequirementsWHERE YOU'LL FIT WITHIN THE TEAM As a Manager, IT Auditor, you will hold a senior individual contributor role within the Internal Audit function, operating as part of the organization's third line of defense. In this role, you will work closely with Global Internal Audit leadership, which reports directly into the Chief Risk Officer and the Board Risk Subcommittee. Your work will focus on providing independent assurance over the design and operating effectiveness of the organization's technology processes and controls through risk-based audit engagements, delivering insights that help management strengthen technology processes, controls, and risk management practices.
Perform and lead assigned IT audit engagements across technology risk areas such as cybersecurity, cloud environments, AI and generative AI, third-party risk, data governance, and IT operations. You will lead end-to-end audit engagements on a continuous or risk-based cycle throughout the year, bringing strong IT audit knowledge and a risk-based perspective to each engagement. The role carries no direct reports to start; you will coach team members on engagements, with the opportunity to take on formal supervisory responsibility as the function grows.
WHAT YOU'LL DO Audit Planning & Execution - Lead assigned IT audit engagements within the approved annual audit plan, developing risk-based audit procedures and testing approaches consistent with established audit methodology and risk priorities.
- Assess the governance and controls around AI and generative AI tools (e.g., Claude, ChatGPT, Copilot), acceptable use, data privacy, model and vendor due diligence, human-in-the-loop review, and output validation.
- Design audit programs, end-to-end process walkthroughs, test procedures, and sampling strategies tailored to the risk profile of each engagement.
- Test core IT general controls, covering logical access and periodic user access reviews, change and configuration management, IT operations and job scheduling, and backup and recovery.
- Test cybersecurity controls, covering vulnerability and patch management, security monitoring and threat detection, identity and access security, and incident response readiness.
- Audit data governance and oversight, including data ownership and stewardship, classification and retention, data quality controls, traceability and access rights, and the effectiveness of governance forums in exercising oversight over data use.
- Identify process gaps and control design weaknesses and recommend sustainable, repeatable control improvements to process owners.
- Review the software development lifecycle, including design approval, secure coding, testing and UAT, release management, segregation of duties, and post-implementation review.
Governance & Stakeholder Engagement - Present audit findings, recommendations, and status updates to senior internal management.
- Provide guidance to stakeholders on IT audit findings, control effectiveness, and identified technology risks.
- Collaborate with the first and second lines of defense to understand and support alignment on established control objectives and risk tolerances.
- Recommend improvements to key controls in collaboration with process and control owners, identify opportunities to reduce duplicative or low-value controls and recommend appropriate improvements, and identify opportunities to improve continuous control monitoring and automated testing.
- Coordinate with external certification bodies, assessors, and third-parties in support of external certification and attestation programs (e.g., CMMC, ISO 27001, SOC 1/SOC 2), including readiness assessments, evidence requests, and findings follow-up.
Reporting & Issue Management - Produce high-quality internal audit reports with clear, risk-rated findings and actionable recommendations.
- Perform root-cause analysis on control failures, distinguishing design gaps from execution breakdowns so remediation addresses the underlying process rather than the symptom.
- Monitor remediation progress, assess management action plans, validate completion of agreed actions, and report status to relevant stakeholders.
- Maintain audit documentation in accordance with IIA Standards and internal quality assurance requirements.
Collaboration & Development - Coach and support team members during assigned audit engagements and provide feedback to promote consistent application of audit methodology.
- Peer review workpapers and support consistent application of established audit methodology across assigned engagements.
- Contribute to enhancements to IT audit tools, analytics, and audit practices, including appropriate use of AI-enabled automation to support audit planning, testing, and reporting.
ABOUT YOU Required Knowledge, Skills & Abilities - Deep understanding of IT risk, control frameworks, and audit methodology (IIA Standards, COSO, COBIT, NIST Cybersecurity Framework).
- Strong knowledge of IT general controls and IT audit methodology, with working knowledge of cybersecurity, cloud risk, vendor management, and related technology risk areas sufficient to assess controls against established frameworks.
- Practical experience auditing data governance and oversight frameworks, including data ownership, classification and retention, data quality, and data traceability.
- Working knowledge of application development lifecycle and change management controls across waterfall, agile, and DevOps delivery models.
- Familiarity with AI risk and governance frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) as applied to enterprise AI deployments.
- Experience supporting external certification and attestation engagements (e.g., CMMC, ISO 27001, SOC 1/SOC 2), including interfacing directly with certification bodies, assessors, or third-parties.
- Proficiency with analytics tools (SQL, Power BI, ACL/Galvanize) and AI assistants such as Claude or ChatGPT to support continuous auditing and automation.
- Able to convey complex technical risk, in writing and verbally, to non-technical audiences and manage stakeholders at all levels.
- Able to coach colleagues and peer review workpapers, holding engagements to a consistent methodology and quality standard.
- High degree of professional scepticism, integrity, and objectivity.
Experience & Qualifications - Bachelor's degree in Information Technology, Computer Science, Accounting Information Systems, or a related field; advanced degree preferred.
- 6-9 years of progressive experience in IT audit, cybersecurity, or IT risk management, including 2-3 years leading audit engagements end to end.
- Prior experience in a Big 4, consulting firm, or regulated industry is a strong asset.
Certifications - CISA - Certified Information Systems Auditor
- ISO 27001 Lead Auditor
Additional Credentials Valued - CRISC - Certified in Risk & Information Systems Control
- Cloud or cyber risk credentials (e.g., CCSP, Security+)
- AI governance credentials (e.g., IAPP AIGP, ISO/IEC 42001 Lead Auditor)
US COMPENSATION INFORMATIONCompensation for this role includes base salary, annual discretionary performance bonus, 401(k) plan with an annual employer contribution based on years of service and Bain's best in class benefits package (details listed below).
Some local governments in the United States require a good-faith, reasonable salary range to be included in job postings for open roles. The estimated annualized compensation for this role is as follows:
- In Georgia, the good-faith, reasonable annualized full-time salary range for this role is between $99,500 and $119,500.
- In Massachusetts, the good-faith, reasonable annualized full-time salary range for this role is between $114,500 and $137,500.
- In Texas, the good-faith, reasonable annualized full-time salary range for this role is between $104,500 and $125,500.
Placement within this range will vary based on several factors including, but not limited to experience, education, licensure/certifications, training and skill level.
- Annual discretionary performance bonus
- This role may also be eligible for other elements of discretionary compensation
- 4.5% 401(k) company contribution, which increases after 3 years of service and is 100% vested upon start date
Bain & Company's comprehensive benefits and wellness program is designed to help employees achieve personal independence, protection and stability in the areas most important to you and your family.
- Bain pays 100% individual employee premiums for medical, dental and vision programs, offering one of the most comprehensive medical plans for employees without impacting your paycheck
- Generous paid time off, including parental leave, sick leave and paid holidays
- Fully vested 401(k) company contribution
- Paid Life and Long-Term Disability insurance
WORKING MODEL / TRAVEL- This role follows a hybrid model, requiring in-office presence at least one day per week.
