IT Auditor II

Brotherhood Mutual; Fort Wayne (IN); On-site; USD 70,000 - 100,000; Full time

Job summary

Brotherhood Mutual IT Auditor II is responsible for independently executing governance, risk, and compliance activities, including internal IT audits and policy review, to ensure effective controls and regulatory compliance. You will collaborate with stakeholders to strengthen IT governance and security posture at our Fort Wayne corporate office.

The role requires 2–3 years of IT auditing or GRC experience, familiarity with SOX/NIST CSF, and an understanding of insurance industry controls.

Qualifications

• Bachelor's degree in IT, Business Administration, or Accounting.
• 2–3 years of external/internal IT auditing or GRC experience.
• CISA and/or CPCU designation is desired.
• Insurance background is highly desired.

Responsibilities

• Assist team lead with risk and control consulting for IT and business units.
• Execute IT Audit Plan items and report findings to leadership.
• Review and update policies to meet industry standards.
• Maintain controls framework and collect metrics for senior management.
• Report audit results and risk/controls projects to management and Audit Committee.
• Coordinate with compliance for cybersecurity and privacy obligations.
• Assist with vendor risk management activities.
• Maintain a risk register for cyber risks.

Skills

IT Audit

Risk Assessment

Regulatory Compliance

SOX

NIST CSF

Communication

Project Management

Education

Bachelor's degree in IT/Business/Accounting

CISA and/or CPCU designation desired

Job description

Job Title: IT Auditor II

FLSA Status: Exempt

Job Family: IT

Department: IT - Information Security

Location: Corporate Office (Fort Wayne, IN)

JOB SUMMARY

Independently execute governance, risk, and compliance activities, including internal IT audits. Assist in reviewing IT policies and standards, collaborating with stakeholders to ensure effective controls and regulatory compliance.

POSITION ESSENTIAL FUNCTIONS AND RESPONSIBILITIES

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Assist the team lead and management with risk and control consulting for IT and business departments with understanding and fulfilling their responsibilities related to IT governance, risk, and compliance.
• Execute IT Audit Plan items assigned by the team lead and management. Prepare or review assigned reports of audit findings and opportunities for improvement and communicate these to appropriate company leadership.
• Review and update assigned policies to ensure they comply with industry standards and corporate needs.
• Assist with maintaining the controls framework for measuring the organization’s controls and risk, assist with the collection of metrics to be reported to Senior Management that display policy compliance, finding remediation, and security posture.
• Follow/support the communication mechanisms to report results of audits, risk/controls consulting projects, and investigations to management and the Audit Committee.
• Work with compliance to ensure legal and regulatory obligations for cybersecurity and privacy are being met as directed by the team lead and management.
• Perform assigned vendor risk management activities.
• Assist the team lead and management in maintaining a risk register for cyber risks affecting the business, providing reasonable assurance that risk management, control, and governance systems are functioning as intended.
• Follow the company’s ERM approach to evaluating risks and ensure the organization’s risk posture is within the risk tolerance limits.
• Assist with the coordination of external audits/reviews and gather/document assigned artifacts for external requests for attestation of security and privacy practices.
• Complete other duties as assigned.

KNOWLEDGE, SKILLS, AND ABILITIES

The requirements listed below are representative of the knowledge, skills, and/or abilities required to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with

disabilities to perform the essential functions.

• Must possess strong written, verbal, and presentation skills.
• Self-motivated with strong interpersonal, communication and analytical skills.
• Strong project management capabilities.
• Understanding of financial audit principles and the Sarbanes-Oxley Act or Model Audit Rule Act.
• Familiarity with NAIC Insurance Data Security Model Law.
• Familiarity with New York DFS Cyber Security Regulations (23 NYCRR 500 and related).
• Familiarity with NIST Cyber Security Framework (NIST CSF).
• Familiarity with Service Delivery and Controls Frameworks (COBIT, NIST, ITIL).
• Familiarity with privacy regulations (e.g. GDPR, CCPA).
• Effectively interface with external contacts, Brotherhood employees, managers, and department staff members.

EDUCATION AND/OR EXPERIENCE

List Degree Requirement, Years' Experience, and Certifications

• Bachelor's degree, preferably in IT, Business Administration, or Accounting required.
• Must have two to three years of external and/or internal information technology, auditing or GRC experience.
• Certified Information Systems Auditor (CISA) and/or Chartered Property and Casualty Underwriter (CPCU) designation is desired.
• An insurance background is highly desired.

Terms and Conditions

This description is intended to describe the general content of and requirements for the performance of this position. It is not to be construed as an exhaustive statement of duties, responsibilities, or requirements.

Because the company’s niche is the church and related ministries market, and because effective service requires a thorough understanding of this market, persons in this position must be familiar with church operations and must conduct themselves in a manner that will neither alienate nor offend persons within this target niche.

Brotherhood Mutual Insurance Company reserves the right to modify, interpret, or apply this position description in any way the company desires. This job description in no way implies that these are the only duties, including essential duties, to be performed by the employee occupying this position. This position description is not an employment contract, implied or otherwise. The

employment relationship remains "at-will".