Senior IT Auditor- IT & Cyber

Internationalinsuranceprofessionals; Charlotte, Northern (NC, KY); On-site; USD 82,000 - 119,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Parental leave

Paid time off

401(k)

Job summary

Moody's is seeking an IT and cybersecurity audit professional to lead risk-based audits across cloud, AI, and modern technology risks. You will develop an understanding of technology environments, processes, and related risks and controls.

You will plan audit scopes, evaluate governance, cloud security, IAM, data protection, and incident response; perform testing and maintain thorough workpapers; translate findings into actionable recommendations and communicate with Cyber, Technology, Data, and

Qualifications

• 3+ years experience in IT audit, cybersecurity, risk, or controls in Big 4 or global org.
• Strong understanding of IT risk management frameworks (NIST, ISO, COBIT, COSO).
• Experience auditing cloud environments (AWS, Azure, SaaS) including security architecture and access controls.
• Knowledge of identity and access management (IAM, PAM, SSO, MFA) and privileged access oversight.
• Understanding of secure development practices (SDLC, Agile, DevOps, DevSecOps) and application security controls.
• Experience using data analytics tools (Excel, Power BI, Tableau) to support audit testing and insights.
• Technical knowledge covering cybersecurity, cloud, data analytics, IAM, network security, vulnerability management, incident response, data protection, third-party risk, and frameworks like NIST, ISO 27001, SOC 2, DORA, CIS Controls.
• Demonstrated proficiency in AI concepts, with hands-on AI tools to streamline workflows and enhance efficiency.

Responsibilities

• Lead and execute IT and cybersecurity audits with a focus on cloud, AI, and modern technology risks.
• Develop understanding of technology environments, business processes, and associated risks and controls.
• Plan audit scope through process analysis, risk assessment, and control identification.
• Evaluate cybersecurity governance, cloud security, identity access management, infrastructure security, and data protection controls.
• Execute audit testing and maintain high-quality, well-documented workpapers.
• Translate technical findings into clear, actionable business insights and recommendations.
• Communicate effectively with stakeholders across Cyber, Technology, Data, and Product teams.
• Track and validate remediation efforts to ensure sustainable control improvements.

Skills

IT audit

Cybersecurity

Cloud security

IAM & Privileged access

Secure SDLC

Data analytics

NIST/ISO/COSO

AI concepts

Education

Bachelor's degree

CISSP/CISA preferred

Tools

Excel

Power BI

Tableau

Job description

At Moody's, we unite the brightest minds to turn today's risks into tomorrow's opportunities. We do this by striving to create an inclusive environment where everyone feels welcome to be who they are-with the freedom to exchange ideas, think innovatively, and listen to each other and customers in meaningful ways. Moody's is transforming how the world sees risk. As a global leader in ratings and integrated risk assessment, we're advancing AI to move from insight to action-enabling intelligence that not only understands complexity but responds to it. We decode risk to unlock opportunity, helping our clients navigate uncertainty with clarity, speed, and confidence.

Skills and Competencies

• Minimum of 3 years of experience in a Big 4 firm or global organization in IT audit, cybersecurity, risk, or controls
• Strong understanding of IT and cybersecurity risk management, controls, and governance frameworks (e.g., NIST, ISO, COBIT, COSO)
• Experience auditing cloud environments (AWS, Azure, SaaS) including security architecture, configurations, and access controls
• Knowledge of identity and access management (IAM, PAM, SSO, MFA) and privileged access oversight
• Understanding of secure development practices (SDLC, Agile, DevOps, DevSecOps) and application security controls
• Experience using data analytics tools (e.g., Excel, Power BI, Tableau) to support audit testing and insights
• Technical Knowledge: Strong understanding of cybersecurity, cloud infrastructure, data analytics, identity and access management, network security, vulnerability management, incident response, data protection, third-party risk management, and industry frameworks such as NIST, ISO 27001, SOC 2, DORA, and CIS Controls.
• Demonstrated proficiency in artificial intelligence concepts, with hands-on experience using AI tools to streamline workflows and enhance operational efficiency. Proven ability to implement AI-powered solutions to solve business challenges. Demonstrates a growing awareness of AI risk management and a commitment to responsible and ethical AI use

Education

• Bachelor's degree required in cybersecurity, computer science, computer engineering, information technology, information systems, or a related field
• Professional certifications such as CISSP, CISA, or equivalent are preferred

Responsibilities

This role is responsible for leading and executing risk-based IT and cybersecurity audits while providing insights on emerging technology risks across the organization.

• Lead and execute IT and cybersecurity audits with a focus on cloud, AI, and modern technology risks
• Develop an understanding of technology environments, business processes, and associated risks and controls
• Plan audit scope through process analysis, risk assessment, and control identification
• Evaluate cybersecurity governance, cloud security, identity access management, infrastructure security, and data protection controls
• Execute audit testing and maintain high-quality, well-documented workpapers
• Translate technical findings into clear, actionable business insights and recommendations
• Communicate effectively with stakeholders across Cyber, Technology, Data, and Product teams
• Track and validate remediation efforts to ensure sustainable control improvements

About the Team

The Internal Audit team is dedicated to delivering independent, objective assurance and advisory services that enhance organizational value and strengthen risk management, control, and governance processes across Moody's global operations.

For US-based roles only: the anticipated hiring base salary range for this position is $82,400.00 - $119,450.00, depending on factors such as experience, education, level, skills, and location. This range is based on a full-time position. In addition to base salary, this role is eligible for incentive compensation. Moody's also offers a competitive benefits package, including not but limited to medical, dental, vision, parental leave, paid time off, a 401(k) plan with employee and company contribution opportunities, life, disability, and accident insurance, a discounted employee stock purchase plan, and tuition reimbursement.

If you need to inquire about a reasonable accommodation, or need assistance with completing the application process, please email [e-mail]. This contact information is for accommodation requests only, and cannot be used to inquire about the status of applications.

Moody's is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, sex, gender, age, religion or creed, national origin, ancestry, citizenship, marital or familial status, sexual orientation, gender identity, gender expression, genetic information, physical or mental disability, military or veteran status, or any other characteristic protected by law. Moody's also provides reasonable accommodation to qualified individuals with disabilities or based on a sincerely held religious belief in accordance with applicable laws.

For San Francisco positions, qualified applicants with criminal histories will be considered for employment consistent with the requirements of the San Francisco Fair Chance Ordinance.

This position may be considered a promotional opportunity, pursuant to the Colorado Equal Pay for Equal Work Act.

Candidates for Moody's Corporation may be asked to disclose securities holdings pursuant to Moody's Policy for Securities Trading and the requirements of the position. Employment is contingent upon compliance with the Policy, including remediation of positions in those holdings as necessary.