Corporate IT Audit Specialist

Job Title

Corporate IT Audit Specialist

Location

Hybrid (Manchester, NH) - In office two days a week (Tuesday & Thursday)

Purpose and Importance of Position

Under the general direction of the VP/Leader of Corporate Audit Services, the Corporate IT Audit Specialist will report to and support the Corporate Audit Services (CAS) Manager in deploying an integrated audit process. As CAS co-sources with a third-party Technology Risk Advisory team for IT risk and audit expertise, this role will engage directly with Technology Risk Advisory management on all IT-related projects.

This role is crucial due to the heavy reliance on the integrity of digitally stored data, as well as the availability and reliability of applications and infrastructure systems in business processes. Additionally, this role supports CAS' data analytics and automation initiatives to extract meaningful insights to enhance audit procedures and the value of audit deliverables.

Essential Functions

Under the supervision of the CAS Manager and co-sourced Technology Risk Advisory team, the Corporate IT Audit Specialist will:

• Evaluate the design and adequacy of Business Process, IT General and Application Controls, as well as other operational controls around the IT infrastructure, applications, and Cybersecurity protocols.
• Execute risk-based audit procedures for IT and Business Process controls in accordance with Sarbanes-Oxley (SOX) requirements.
• Investigate and address complex issues and control deficiencies, collaborating with responsible management to develop effective solutions/action plans.
• Identify opportunities to drive continuous improvement within the CAS function, proactively delivering insights, promoting and sharing knowledge.
• Provide technology-related guidance to CAS team members to progressively increase team knowledge of IT auditing concepts and techniques.
• Leverage technology and automation/data analytics tools to extract meaningful insights and streamline audit procedures with increased audit coverage and efficiencies.
• Conduct IT risk assessments and advisory engagements for new systems or upgrades, changes in processes and operations, data migrations, etc., and advise management on appropriate risks and control requirements.
• Stay abreast of emerging technical trends, and cyber-related risk exposures that impact critical business processes, and the potential impact on Enterprise-level risks.
• Build and maintain strong relationships with IT business partners across the company - be recognized as a trusted partner and advisor providing quality insight regarding IT risks and controls.
• Participate in special projects, analysis and reporting as requested by management.
• Collaborate with external auditors to maintain a high level of reliance and leveraging of IT audit-related work.
• Utilize the AuditBoard Connected Risk GRC solution to maintain and govern IT-related risks and controls, in addition to supporting CAS' role as gatekeeper of RiverStone's risk register and control matrix.
• Leverage automation/data analytics tools to enhance audit work (i.e., Alteryx, SQL).

Organizational

• Contributes to an environment in which innovative thinking is encouraged and fostered throughout the organization; takes ownership of innovation in their respective areas to ensure ideas are converted into business and technical solutions; embraces calculated risk taking and is willing to accept a reasonable degree of failure as a stepping stone to progress.
• Takes ownership of process improvement in their respective areas to ensure that ideas are implemented and continuously reviewed.
• Embed a strong customer service focus into the organization and ensure the consistent delivery of superior customer service.
• Demonstrates alignment with RiverStone's Commitments.
• Maintain external relationships with external auditors, business partners, outsourced service providers, and other Fairfax entities.

Required Skills

• Drive and 'grit' to quickly gain good knowledge and understanding of RiverStone's organization structure, critical business processes, data governance, and RTS operations, standards, and policies.
• Professional curiosity and inquisitiveness to draw on relevant guidance and knowledge sources to improve risk management practices and understanding of current business and industry trends.
• Developing relationship management skills.
• Solid critical thinking and analytical skills.
• Strong interpersonal skills including the ability to interact professionally and effectively with all levels of management including senior leaders.
• Demonstrated strength in interpreting results against defined criteria to ensure work is competently and efficiently performed in accordance with IIA and other relevant professional standards.
• Well-organized, highly-motivated self-starter that is detail-oriented and able to manage multiple tasks.
• Ability to build credibility with, collaborate with, and influence business partners and stakeholders..
• Demonstrated ability in the preparation of detailed and well-organized audit work papers, documenting testing procedures, issues, and agreed upon action plans.
• Incorporate feedback from senior CAS and co-sourced Technology Risk Advisory team members to enhance skills and performance.
• Clear and concise written communication skills and effective verbal communication skills to convey audit issues.
• Ability to confidently produce accurate and timely deliverables in a highly dynamic work environment with a strong 'client' focus mindset.
• Take full responsibility for assigned activities/tasks, including consistent self-review of work to progressively improve approach for producing high-quality deliverables.
• Operates with a high standard of ethics and professionalism.
• Capable of maintaining a high degree of confidentiality.
• In depth knowledge of relevant professional standards and frameworks (e.g., IIA IPPF, ISO 17799/27001, COBIT 5 and COSO frameworks, etc.).
• Knowledge of database concepts (e.g., Azure, SQL)
• Above average technical understanding and acumen, including data analytics and automation proficiency.
• Ability to constructively work independently and in collaborative environments involving all levels of management and associates across the business.

Experience

• 1 to 3 years of internal/external IT audit, Technology/IT operational risk management
• Strong technical experience with Excel and Microsoft applications for analytics and presentation
• Demonstrated experience supporting IT risk and audit projects across multiple business lines, including assessment of IT risks and the design and adequacy of mitigating controls
• Working knowledge and experience with IT operations, cybersecurity principles, and emerging technologies including cloud-based applications and agile software development
• Familiarity with the regulatory environment and how technology risks are viewed
• Experience in the financial or insurance sector a plus

Required Education

Bachelor's Degree in Information Technology or Business fields with an interest in Computer Information Systems or Management Information Systems, equivalent work experience

Preferred Education or Certification

Certification(s) - Certified Information Systems Auditor (CISA); Certified Internal Auditor (CIA); Certified in Risk and Information Systems Control (CRISC); Associate in Insurance Data Analytics (AIDA); AuditBoard Certifications - desired but not required.

Candidate will have the ability to commit to obtaining a professional certification within 12 months of hire date.

Supervisory Role

In a limited capacity, provide general instructions and assign responsibility for specific results, based upon established guidelines. May perform first-line review of deliverables provided by junior associates.

Travel

Minimal. Examples may include occasional site visits to US Runoff locations, or Fairfax affiliates, as well as external training opportunities.

Work Environment / Physical Demands

This position operates in a professional, collaborative environment and must have the ability to timely produce thorough, accurate work with many competing demands, deadlines, and distractions. The position uses standard equipment such as phones, computers, copiers/printers and filing cabinets. Noise level is moderate.

Other Duties (Disclaimer Statement)

RiverStone retains the right to change or assign other duties to this position as needed, or other duties or responsibilities may change or be assigned as needed.

Core Competencies

Perspective: Looks toward the broadest possible view of an issue/challenge; has broad ranging personal and business interests and pursuits; can easily pose future scenarios; can think globally; can discuss multiple aspects and impacts of issues and project them into the future.

Developing Direct Reports and Others: Provides challenging and stretching tasks and assignments; holds frequent development discussions; is aware of each person's career goals; constructs compelling development plans and executes them; pushes people to accept developmental moves; will take on those who need help and further development; cooperates with the developmental system in the organization; is a people builder.

Conflict Management: Steps up to conflicts, seeing them as opportunities; reads situations quickly, good at focused listening; can hammer out tough agreements and settle disputes equitably; can find common ground and get cooperation with minimum noise.

Organizational Agility: Knowledgeable about how organizations work; knows how to get things done both through formal channels and the informal network; understands the origin and reasoning behind key policies, Practices, and procedures; understands the cultures of organizations.

Building Effective Teams: Blends people into teams when needed; creates strong morale and spirit in his/her team; shares wins and successes; fosters open dialogue; lets people finish and be responsible for their work; defines success in terms of the whole team; creates a feeling of belonging in the team.

Managing and measuring work: Clearly assigns responsibility for tasks and decisions; sets clear objectives and measures; monitors process, progress, and results; designs feedback loops into work.

Written communications: Is able to write clearly and succinctly in a variety of communication settings and styles; can get messages across that instigate appropriate actions.

Diversity, Equity, Inclusion & Belonging

RiverStone Resources, LLC is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, LGBTQ+, national origin, gender identity, disability, protected veteran status, or any other characteristic protected by law.

Privacy Notice for California Residents

https://www.trg.com/california-consumer-privacy-notice/