IT Audit Lead

Fred Loya Insurance Agency; San Antonio (TX); On-site; USD 120,000 - 160,000; Full time

Job summary

Loya Insurance is seeking an experienced IT Audit Lead to build and scale a technology audit and assurance capability. This role will provide independent, risk-based assurance over IT controls supporting financial reporting, cybersecurity, data privacy, regulatory compliance, and critical business operations.

The successful candidate will blend strong audit judgment with technical depth to engage with engineers, security leaders, data teams, and executives.

Qualifications

• Bachelor’s degree or equivalent experience in a related field.
• 8+ years of progressive experience in IT audit, technology risk, or cybersecurity assurance.
• Experience leading complex technology audits from assessment to reporting and follow-up.
• Strong knowledge of IT general controls and technology risk across IAM, PAM, change management, cloud, and third-party risk.
• Ability to translate technical risk into business terms and actionable remediation.

Responsibilities

• Develop and maintain a risk-based technology audit universe and annual assurance plan.
• Lead technology audits from planning through testing, reporting, and remediation follow-up.
• Assess IT general controls across identity management, privileged access, change management, and infrastructure.
• Evaluate controls supporting SOX 404, GLBA, and NAIC cybersecurity expectations.
• Communicate audit findings and risk implications to senior leadership.

Skills

Audit leadership

IT risk assessment

Communication skills

Problem solving

Independent judgment

Education

Bachelor's degree in information systems or related field

Equivalent relevant experience

Tools

SQL

Python

PowerShell

APIs

BI tools

GRC platforms

Job description

Loya Insurance is seeking a hands-on IT Audit Lead to build and lead a scalable technology audit and assurance capability. The role will provide independent, risk-based assurance over the technology controls that support financial reporting, cybersecurity, data privacy, regulatory compliance, and critical business operations.

The successful candidate will combine strong audit judgment with enough technical depth to work credibly with engineers, security leaders, data teams, and senior executives.

Key Responsibilities

• Assist with the develop and maintain a risk-based technology audit universe and annual assurance plan aligned with enterprise risk and regulatory priorities.
• Lead complex technology audits from planning and scoping through testing, reporting, and remediation follow-up.
• Assess IT general controls and technology risks across identity and access management, privileged access, change management, infrastructure, cloud, applications, cybersecurity, resilience, and third parties.
• Evaluate technology controls supporting a SOX 404 environment, Gramm-Leach-Bliley Act (GLBA), NAIC cybersecurity expectations, financial reporting, privacy, and critical operations.
• Establish practical audit methodology, evidence standards, workpaper expectations, repeatable testing, issue validation, and risk reporting.
• Translate technical observations into clear business risk, root cause, impact, accountable ownership, and actionable remediation recommendations.
• Partner constructively with Technology, Cybersecurity, Compliance, Finance, Data, and AI teams while maintaining third-line independence.
• Use data analytics, scripting, APIs, GRC tooling, or other automation to expand coverage and reduce dependence on manual sampling.
• Provide concise reporting on technology risk themes, audit results, remediation progress, emerging threats, and significant initiatives to senior leadership.

Required Qualifications and Skills

• Bachelor’s degree in information systems, computer science, accounting, finance, cybersecurity, business, or a related field; equivalent relevant experience may be considered in lieu of degree.
• Eight or more years of progressive experience in IT audit, technology risk, cybersecurity assurance, technology controls, or a closely related discipline.
• Demonstrated experience leading complex technology audits and managing work from risk assessment through final reporting and issue follow-up.
• Strong working knowledge of IT general controls, including logical access, privileged access, change management, technology operations, backup and recovery, and third-party technology risk.
• Ability to assess control design and operating effectiveness, evaluate evidence, identify root cause, and develop risk-based conclusions.
• Strong written, verbal, workshop facilitation, and presentation skills, including the ability to explain technical risk in business terms.
• Sound judgment, professional skepticism, independence, and the ability to operate effectively in a changing environment with limited existing structure.

Preferred Qualifications and Skills

• Experience building or enhancing the maturity of an IT audit, technology assurance, or technology risk program.
• Insurance or other regulated financial-services experience, including exposure to a SOX 404 environment, GLBA, NAIC cybersecurity requirements, or comparable regulatory frameworks.
• Working knowledge of modern IT environments and related controls, including cloud infrastructure, network and endpoint security, identity and privileged access management (IAM/PAM), vulnerability management, system development and change management (SDLC/DevOps), APIs, and cybersecurity practices.
• Experience assessing data governance, privacy, artificial intelligence, model risk, or automated decision systems.
• Hands-on experience with audit analytics or automation using SQL, Python, PowerShell, APIs, BI tools, or GRC platforms.
• Experience presenting to senior executives, or a board-level audience.
• CISA strongly preferred. CISSP, CIA, CRISC, CPA, CCSK, or relevant cloud/security certifications are additional strengths; technical depth and judgment should take precedence over certification count.