IT Auditor II

IT Auditor II

Independently execute governance, risk, and compliance activities, including internal IT audits. Assist in reviewing IT policies and standards, collaborating with stakeholders to ensure effective controls and regulatory compliance.

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Assist the team lead and management with risk and control consulting for IT and business departments with understanding and fulfilling their responsibilities related to IT governance, risk, and compliance.
• Execute IT Audit Plan items assigned by the team lead and management. Prepare or review assigned reports of audit findings and opportunities for improvement and communicate these to appropriate company leadership.
• Review and update assigned policies to ensure they comply with industry standards and corporate needs.
• Assist with maintaining the controls framework for measuring the organization's controls and risk, assist with the collection of metrics to be reported to Senior Management that display policy compliance, finding remediation, and security posture.
• Follow/support the communication mechanisms to report results of audits, risk/controls consulting projects, and investigations to management and the Audit Committee.
• Work with compliance to ensure legal and regulatory obligations for cybersecurity and privacy are being met as directed by the team lead and management.
• Perform assigned vendor risk management activities.
• Assist the team lead and management in maintaining a risk register for cyber risks affecting the business, providing reasonable assurance that risk management, control, and governance systems are functioning as intended.
• Follow the company's ERM approach to evaluating risks and ensure the organization's risk posture is within the risk tolerance limits.
• Assist with the coordination of external audits/reviews and gather/document assigned artifacts for external requests for attestation of security and privacy practices.
• Complete other duties as assigned.

The requirements listed below are representative of the knowledge, skills, and/or abilities required to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Must possess strong written, verbal, and presentation skills.
• Self-motivated with strong interpersonal, communication and analytical skills.
• Strong project management capabilities.
• Understanding of financial audit principles and the Sarbanes-Oxley Act or Model Audit Rule Act.
• Familiarity with NAIC Insurance Data Security Model Law.
• Familiarity with New York DFS Cyber Security Regulations (23 NYCRR 500 and related).
• Familiarity with NIST Cyber Security Framework (NIST CSF).
• Familiarity with Service Delivery and Controls Frameworks (COBIT, NIST, ITIL).
• Familiarity with privacy regulations (e.g. GDPR, CCPA).
• Effectively interface with external contacts, Brotherhood employees, managers, and department staff members.

List Degree Requirement, Years' Experience, and Certifications

• Bachelor's degree, preferably in IT, Business Administration, or Accounting required.
• Must have two to three years of external and/or internal information technology, auditing or GRC experience.
• Certified Information Systems Auditor (CISA) and/or Chartered Property and Casualty Underwriter (CPCU) designation is desired.
• An insurance background is highly desired.

This description is intended to describe the general content of and requirements for the performance of this position. It is not to be construed as an exhaustive statement of duties, responsibilities, or requirements.

Because the company's niche is the church and related ministries market, and because effective service requires a thorough understanding of this market, persons in this position must be familiar with church operations and must conduct themselves in a manner that will neither alienate nor offend persons within this target niche.

Brotherhood Mutual Insurance Company reserves the right to modify, interpret, or apply this position description in any way the company desires. This job description in no way implies that these are the only duties, including essential duties, to be performed by the employee occupying this position. This position description is not an employment contract, implied or otherwise. The employment relationship remains "at-will".

Equal Opportunity Employer This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.