Senior Manager, Cybersecurity & Technology Risk Audit

Job Description: Senior Manager, Cybersecurity & Technology Risk Audit

Department: Internal Audit

Reports To: Vice President, Internal Audit

Location: Corporate Headquarters, Wallingford, CT (In person)

Overview

As a senior leader within the Internal Audit Department, the Senior Manager, Cybersecurity & Technology Risk Audit, is responsible for providing independent assurance and strategic advisory services over the Company's cybersecurity, technology risk, and digital transformation landscape.

This role serves as Internal Audit's subject matter expert for cybersecurity and technology risk, partnering closely with VP of IT, and other business leaders to evaluate cyber resilience, technology governance, and the effectiveness of enterprise security controls.

The Senior Manager leads complex cybersecurity audits, evaluates emerging technology risks, advises management on strategic technology initiatives, and helps strengthen the Company's overall cyber posture while maintaining the independence required of the Internal Audit function. While the role will have familiarity with IT General Controls (ITGCs), its primary focus is evaluating enterprise cybersecurity capabilities, technology risk management, operational resilience, and emerging technology risks.

Key Responsibilities

Cybersecurity & Technology Risk Leadership

• Lead the development and execution of the Company's cybersecurity and technology risk audit strategy as part of the annual risk-based Internal Audit Plan.
• Serve as the Internal Audit subject matter expert on cybersecurity, technology risk, and digital transformation.
• Partner with the Vice President of Internal Audit to identify emerging technology and cybersecurity risks and incorporate them into the annual audit plan.
• Continuously monitor the external cyber threat landscape, evolving regulatory requirements, and emerging technologies to ensure audit coverage remains aligned with enterprise risks.
• Coordinate cybersecurity audit activities with external specialists, co-sourced providers, and external auditors as appropriate.

Cybersecurity Assurance

Lead independent assessments of the design and operating effectiveness of controls across areas including:

• Cybersecurity Governance
• Security Operations (SOC)
• Identity & Access Management (IAM)
• Privileged Access Management (PAM)
• Cloud Security (AWS, Azure, GCP)
• Network and Infrastructure Security
• Endpoint Security
• Vulnerability & Patch Management
• Threat Detection & Incident Response
• Data Protection & Encryption
• Third-Party & Supply Chain Cyber Risk
• Disaster Recovery & Business Continuity
• Operational Technology (OT/ICS), where applicable
• Artificial Intelligence (AI) Governance and Security
• Secure Software Development (DevSecOps)

Evaluate cybersecurity programs against leading frameworks including NIST Cybersecurity Framework, NIST 800-53, ISO 27001, CIS Critical Security Controls, COBIT, and applicable privacy and cybersecurity regulations.

Advisory & Consulting

• Serve as a trusted advisor to VP of IT, and other business leaders on cybersecurity governance, technology risk, and control effectiveness.
• Provide independent, risk-focused advisory services for major technology initiatives including cloud migrations, cybersecurity transformations, ERP implementations, AI initiatives, identity modernization, Zero Trust implementation, and digital transformation programs.
• Participate in steering committees, governance forums, and strategic technology initiatives as an independent advisor to identify risks early and recommend effective control design.
• Facilitate technology and cybersecurity risk assessments, cyber maturity assessments, tabletop exercises, and control design workshops.
• Benchmark the Company's cybersecurity capabilities against industry leading practices and peer organizations.
• Advise management on opportunities to improve cyber resilience through automation, continuous monitoring, data analytics, and emerging technologies while maintaining Internal Audit independence.

Risk Assessment

• Lead the annual enterprise cybersecurity and technology risk assessment.
• Develop technology risk matrices and control frameworks that support the annual audit plan.
• Identify and evaluate technology, cybersecurity, regulatory, operational, and emerging risks across all business units.
• Monitor evolving cyber threats, AI risks, regulatory developments, and geopolitical events that could impact the Company's risk profile.

Audit Planning

• Develop risk-based audit scopes and work programs focused on cybersecurity, technology governance, operational resilience, and digital risks.
• Schedule audits and advisory engagements based on enterprise risk and business priorities.
• Lead the planning, scoping, and execution of cybersecurity audit and consulting engagements.
• Develop audit methodologies covering cloud security, artificial intelligence, cybersecurity, data privacy, digital transformation, and emerging technologies.

Audit Execution

• Partner with VP of IT, and other business leadership to understand technology risks and strategic initiatives.
• Evaluate the effectiveness of enterprise cybersecurity governance, security operations, cloud environments, security architecture, identity management, privileged access, third-party cyber risk, and operational resilience.
• Assess security controls supporting critical business applications, digital platforms, cloud environments, and enterprise infrastructure.
• Perform targeted reviews of IT General Controls (ITGCs) where appropriate while coordinating closely with the Senior Manager responsible for the Company's ITGC and SOX program.
• Assess the Company's preparedness for cybersecurity incidents through reviews of incident response, vulnerability management, ransomware preparedness, disaster recovery, and business continuity capabilities.
• Ensure audit documentation supports conclusions and complies with Internal Audit quality standards.
• Maintain objectivity and independence while delivering practical, business-focused recommendations.

Reporting & Stakeholder Engagement

• Prepare concise, executive-level reports communicating cybersecurity risks, technology control deficiencies, business impacts, root causes, and practical recommendations.
• Present audit results, cyber risk assessments, and advisory observations to executive management and senior leadership.
• Partner with management to develop sustainable remediation strategies that strengthen cybersecurity while supporting business objectives.
• Monitor remediation efforts and validate implementation of agreed corrective actions.
• Escalate significant cybersecurity risks and control deficiencies to executive management, the Vice President of Internal Audit, and the Audit Committee, as appropriate.
• Maintain oversight of technology and cybersecurity audit findings to ensure timely and effective remediation.

Continuous Improvement

• Drive innovation within the Internal Audit function through automation, continuous auditing, data analytics, AI-enabled auditing, and technology-enabled assurance techniques.
• Enhance cybersecurity audit methodologies and technology risk assessment capabilities.
• Stay current on emerging cyber threats, regulatory developments, security technologies, and industry leading practices.
• Mentor and develop Internal Audit staff while serving as the department's technical resource for cybersecurity and technology risk.

Qualifications

Education

Bachelor's degree in Information Systems, Cybersecurity, Computer Science, Information Technology, Engineering, Accounting, or another related STEM discipline.

Master's degree preferred.

Professional Certifications

One or more of the following certifications is required:

• Certified Information Systems Auditor (CISA)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Internal Auditor (CIA)

Additional certifications such as CCSP, GIAC, CEH, Security , or cloud security certifications are preferred.

Experience

• 8-12 years of progressive experience in cybersecurity, technology risk, cyber consulting, cyber assurance, or IT audit, with a significant focus on enterprise cybersecurity.
• Experience within a Fortune 500, Big Four Cyber Risk practice, or leading cybersecurity consulting firm strongly preferred.
• Demonstrated experience leading complex cybersecurity audits and advisory engagements across large, global organizations.
• Experience evaluating enterprise cybersecurity programs, cloud security, cyber resilience, operational resilience, and technology governance.
• Working knowledge of IT General Controls (ITGCs) and SOX requirements, with the ability to coordinate effectively with audit leaders responsible for ITGC assurance.
• Deep knowledge of cybersecurity frameworks including NIST CSF, NIST 800-53, ISO 27001, CIS Controls, COBIT, and applicable cybersecurity and privacy regulations.
• Experience partnering with Chief Information Security Officers, technology executives, and business leadership on cybersecurity risk management and governance.
• Strong executive presence with exceptional communication, presentation, stakeholder management, and report-writing skills.
• Demonstrated ability to translate complex technical risks into clear business impacts and actionable recommendations.
• Experience leveraging data analytics, automation, and continuous monitoring to enhance audit effectiveness.