Best suited to candidates with 5+ years of IT auditing experience working in regulated environments like healthcare.
Derived from job-description analysis by Serendipath's career intelligence engine.
Original posting from Blue Shield of California
Your Role
The Senior Internal IT Auditor leads and executes audit engagements, serving as a subject matter resource and ensuring high-quality audit delivery across technology and cybersecurity domains.
Your Work
In this role, you will:
Be responsible for performing and leading transactional quality review audits with limited or no supervision
Have expert knowledge of transactional quality assurance audit principles and methodology; considered a subject matter expert in multiple functional areas
Support risk assessments and development of audit plans for data and AI governance areas
Review controls over AI-enabled business processes, including data sourcing, model outputs, decisioning logic, and human oversight mechanisms
Leads corrective/ preventive action planning related to transactional audits
Assess design and operating effectiveness of controls related to intellectual property (IP) protection, including source code repositories, model artifacts, proprietary algorithms, and data assets
Perform audits of DevSecOps pipelines, including CI/CD tooling, automated testing, code promotion, and segregation of duties across development environments
Evaluate risks related to use of open-source software, third-party libraries, and external AI services, including licensing compliance, security vulnerabilities, and data leakage
Analyze risks associated with data used in software and AI development, including data governance, quality, lineage, privacy, and regulatory compliance (e.g., HIPAA data considerations)
Assess AI governance frameworks, including intake, approval, ethical review, monitoring, incident management, and model retirement processes
Research issues and shares the findings of that work with varying groups effectively (executives, managers, line staff, etc.). Messaging is appropriate to audience
Develop and maintains productive client and staff relationships through individual contacts and group meetings
Be proficient in either operational, financial or IT auditing, but not yet an expert. Work still needs oversight to be released and reviewed by Management
Work to achieve operational targets with direct impact on BSC departmental results
Work independently under limited supervision
Be responsible for entire projects or processes within BSC annual audit program
Communicate with parties within and outside of BSC with the ability to educate others on complex disciplines
May have responsibility for communicating with parties’ external to the organization (e.g., customers, vendors, etc.)
Works to influence parties within and outside of the BSC at an operational level regarding policies, practices, and procedures
Stay updated on data and AI trends, technologies, and regulations, applying insights to audit engagements and supporting the education of data and AI risks and controls to audit teams
Your Knowledge and Experience
Requires a Bachelor’s degree or High School Diploma/GED and 4 years of additional relevant experience in lieu of a degree
Requires a minimum of 5 years of prior relevant experience
Basic competence and knowledge with support from others of: Financial Accounting and Finance Concepts, Managerial Accounting, Regulatory, Legal and Economics, Quality Framework, Ethics and Fraud, Information Technology, Governance, Risk and Controls, Organizational Theory and Behavior
Working knowledge of AI tools, models, and platforms (e.g., generative AI, ML systems), including associated risks, controls, and governance consideration
Strong analytical and problem-solving skills
Typically, requires advanced knowledge of auditing typically obtained through advanced education combined with experience. May have practical knowledge of project management
Familiarity with frameworks such as COBIT, NIST, ISO, or HIPAA
Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), Certified Information Systems Security Professional (CISSP), Certified Internal Auditor (CIA) and/or Certified Secure Software Lifecycle Professional (CSSLP) desired
Experience in software development, including SDLC methodologies (Agile, DevOps, CI/CD) and modern engineering practices
Familiarity with secure coding practices, code management tools (e.g., Git-based repositories), and application security controls
Understanding of data governance and data protection principles, including privacy, confidentiality, regulatory compliance, and intellectual property management
Experience auditing or implementing AI governance frameworks (e.g., NIST AI RMF, internal AI governance programs)
Experience with AI/ML model risk management, including validation, bias detection, explainability, and monitoring
Familiarity with secure AI development practices and emerging AI risk domains (prompt injection, data poisoning, model leakage, etc.)
Experience in the management, governance, and control of Artificial Intelligence (AI) use
Experience in regulated environments (e.g., healthcare)
Hybrid
This role requires employees to be in-office based on our hybrid workplace model, balancing purposeful in-person collaboration with flexibility. For most teams, this means coming into the office two days each week. Employees living more than 50 miles from an office location will work with their manager to determine in-office time based on business need.