The posting
Why USAA?
At USAA, our mission is to empower our members to achieve financial security through highly competitive products, exceptional service and trusted advice. We seek to be the #1 choice for the military community and their families.
Embrace a fulfilling career at USAA, where our core values – honesty, integrity, loyalty and service – define how we treat each other and our members. Be part of what truly makes us special and impactful.
We are proud to support active-duty military spouses. USAA roles may offer remote or hybrid flexibility for active-duty military spouses consistent with applicable policy and business needs.
The Opportunity
As an Audit Manager – IT/IS, you will manage and lead risk-based assurance and advisory engagements focused on automated controls and risks across the organization’s lines of business. You will lead engagements of varying complexity as Auditor-in-Charge (AIC) and participate in complex, cross-functional audits spanning technology and information security, ensuring the quality of audit work.
You will manage strategic initiatives and assist with the development and implementation of the risk-based audit plan. Serving as, or partnering with, audit, business stakeholders, and IT/IS subject matter experts, you will analyze issues, establish collaborative client relationships, and proactively work with management to assess risk and improve internal controls. The role maintains knowledge of large financial services regulations, including the Office of the Comptroller of the Currency’s Heightened Standards and the Federal Reserve Board’s Large Financial Institution Rating System.
The Audit Manager - IT/IS adheres to the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing (Standards), Code of Ethics, and the organization's audit methodology.
We offer a flexible work environment that requires an individual to be in the office 4 days per week. This position can be based in one of the following locations: San Antonio, TX, Plano, TX, or Charlotte, NC. Relocation assistance is not available for this position.
What you’ll do:
- Primarily serves as Auditor-in-Charge (AIC) and main point of contact for the business through IT/IS Audit engagements; manage planning, scoping, execution, reporting, follow-up, and continuous monitoring activities.
- Leads and executes complex IT/IS audit engagements throughout the audit lifecycle and leads continuous monitoring and advisory activities, special reviews, and investigations.
- Manages day to day engagement-related efforts and assignments of Audit team members with varying degrees of expertise and experience when conducting engagements as the Auditor-in-Charge (AIC).
- Develops and independently updates IT/IS risk and control matrix at the engagement level for each engagement.
- Performs detailed review of work by team members; providing feedback/questions and completes audit team end of engagement evaluations when applicable.
- Ensures engagements are completed objectively, professionally, and in accordance with corporate and industry audit standards. Make recommendations for severity ratings to IT Lead Audit Manager and / or Director.
- Identifies control weaknesses and opportunities for improvement in the current operating environment and provides recommendations for corrective action; drafts the related audit issues and audit reports for issuance to respective client leadership.
- Communicates effectively with the business/clients and delivers risk-based and difficult messages regarding issues and control weaknesses to ensure proper risk assurance coverage.
- Provides day to day coaching guidance and on the job training to team members to ensure development, quality, and timely audit engagement deliverables.
What you have:
- Bachelor’s degree; four additional years of related experience beyond minimum required may be substituted in lieu of a degree. 4 years of audit, financial, insurance, banking, information technology or related business and/or leadership experience.
- 6 years of audit or controls experience in a financial services or technology/information security environment.
- 2 years audit experience in the technology and/or information security (IT/IS) areas.
- Experience performing internal audits, external audits, or applying audit, risk, or compliance acumen in a complex operational and regulatory environment.
- Working knowledge of IT/IS controls in areas to include Technology infrastructure management and platforms (e.g., mainframe, midrange, distributed), Network architecture and security (e.g., network segmentation, firewalls, proxies, encryption protocols, endpoint protection).
- Knowledge of internal audit principles to examine, analyze, assess, and draw conclusions from audit work and present findings to multiple audiences.
- Demonstrated experience communicating effectively, constructively challenging IT/IS risks and controls with business partners and influencing business outcomes.
- Experience overseeing work with internal and external partners in a highly collaborative environment.
- Demonstrated critical-thinking and decision-making abilities.
- Understanding of IT/IS risks and internal controls and the ability to evaluate and determine adequacy and efficiency of controls.
- Experience mentoring and providing feedback to team members.
- Experience in highly dynamic environment and ability to deal with competing priorities.
- Knowledge of specific industry frameworks and standards to include COBIT, NIST 800-53, NIST CSF, CRI Profile, OWASP, STIGs, CIS Benchmarks, ISO 27001/2, SOC 2, PCI DSS, ITIL, and FFIEC booklets (e.g., information security, business continuity, etc.).
- Experience with compliance requirements including GDPR, GLBA, and CCPA.
- Knowledge of large financial services regulations (e.g., Office of the Comptroller of Currency’s Heightened Standards and Federal Reserve Board’s Large Financial Institution Rating System).
- Experience working with IT general controls, technology infrastructure management and platforms (such as mainframe, midrange, and distributed systems), and network architecture and security (such as network segmentation, firewalls, proxies, encryption protocols, and endpoint protection), or related work supporting data processing, storage, and protection.
What sets you apart:
- Experience leading IT Integrated audits with operational audit teams to identify, assess, and report on business application controls supporting key business processes.
- Experience leading IT Integrated audits in large financial services, insurance, public accounting, or other highly regulated industries.
- Experience assessing controls across complex processes, including automated controls, system configurations, interfaces, data flows, and system-generated reports supporting critical business and financial processes.
- Experience evaluating IT General Controls (ITGCs), including identity and access management, change management, technology operations, and software development controls, and assessing their impact on business-process and application-level risks.
- Experience partnering with operational, financial, compliance, and risk audit teams to translate complex technology risks into clear business impacts and develop integrated audit approaches that provide holistic assurance.
- Experience leading complex technology audit engagements, including risk assessment, audit planning and scoping, test strategy development, issue identification, root cause analysis, and communication of results to senior management.
- Demonstrated ability to identify emerging technology risks and evaluate the effectiveness of technology risk management and governance including risks associated with automation, artificial intelligence, and evolving technologies.
- Experience leveraging data analytics, continuous monitoring, or automated testing techniques to enhance audit coverage, identify risk patterns, and improve the efficiency and effectiveness of technology assurance activities.
- Professional certifications such as Certified Information Systems Auditor (CISA), Certified Internal Auditor (CIA), Certified Information Systems Security Professional (CISSP), Certified Public Accountant (CPA), or other relevant technology, cybersecurity, risk, or audit certifications.
Compensation range: The salary range for this position is: $114,080.00- $218,030.00.
USAA does not provide visa sponsorship for this role. Please do not apply for this role if at any time (now or in the future) you will need immigration support (i.e., H-1B, TN, STEM OPT Training Plans, etc.).
Compensation: USAA has an effective process for assessing market data and establishing ranges to ensure we remain competitive. You are paid within the salary range based on your experience and market data of the position. The actual salary for this role may vary by location.
Employees may be eligible for pay incentives based on overall corporate and individual performance and at the discretion of the USAA Board of Directors.
The above description reflects the details considered necessary to describe the principal functions of the job and should not be construed as a detailed description of all the work requirements that may be performed in the job.
Benefits: At USAA our employees enjoy best-in-class benefits to support their physical, financial, and emotional wellness. These benefits include comprehensive medical, dental and vision plans, 401(k), pension, life insurance, parental benefits, adoption assistance, paid time off program with paid holidays plus 16 paid volunteer hours, and various wellness programs. Additionally, our career path planning and continuing education assists employees with their professional goals.
For more details on our outstanding benefits, visit our benefits page on USAAjobs.com.
Applications for this position are accepted on an ongoing basis, this posting will remain open until the position is filled. Thus, interested candidates are encouraged to apply the same day they view this posting.
USAA is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
