Audit Manager, Information Security & Risk Management

Responsibilities:

• Develop audit program and plans, determine scope of audit coverage, and organize and manage internal and external audit engagements.
• Oversee the process of audits, making recommendations on policies, and ensuring that the organization fulfills compliance obligations.
• Coordinates and/or performs audit work, reviews audit reports prior to formal release, reviews management responses and reviews supporting workpapers to ensure reports are properly supported.
• Identifies factors causing deficient conditions and provides constructive, economical, and practical recommendations for audit findings. Drafts recommendations for management responses and corrective action plans.
• Support iterative review of assessment results, working with appropriate stakeholders across the lines of defense.
• Follows-up to determine adequacy and implementation of corrective actions.
• Identify and manage implementation of new compliance requirements/controls that are introduced by changes to regulations/standards/frameworks (new compliance requirements introduced per changes to ISO 27001, SOC 2, NIST 800-53, NIST CSF, GDPR)
• Participate and provide input during policy annual reviews.
• Educate control owners to submit risks/exceptions and support risk assessments.
• Design automated and manual control testing methods.
• Conduct compliance assessments and internal control testing of critical business processes, critical information systems/assets (technology/application) and processes to evaluate design and operating effectiveness of controls, and proactively prepare stakeholders for external audits.
• Participate in policy reviews and provide meaningful feedback; facilitate policy operationalization
• Establishes and maintains effective working relationships with Control Owners and Control Operators.
• Support and advise Control Owners and Control Operators to:
• • build programs based on principles: compliance-by-design and security-by-design,
• • proactive evidence collection for audits using GRC Tool,
• • validate evidence for sufficiency per control requirements,
• • remediate findings.
• Create collateral to promote culture of compliance aligned to firm’s risk tolerance.
• Contribute to the development of scalable models and tools that speed up both decision making and accuracy for the organization.
• Assimilate risk and compliance assessment/audit data into concise and meaningful reports/dashboards for leadership.

What we offer:

• Hybrid working model (2 days in the office and 3 days working remotely).
• Stable employment with an employment contract, private medical care, and a benefits package including MultiSport and a benefits platform.
• Opportunity to work in an international environment and collaborate with experienced Grant Thornton experts and professionals from around the world.
• A culture based on teamwork, trust, and knowledge sharing.
• A well-structured onboarding program to support a smooth start and successful integration into your new role.
• Clear career development paths and access to learning and certification programs.
• Access to training platforms and tools that support professional growth.
• An inclusive workplace that welcomes people with disabilities.
• A modern office in Poznań, located in Malta Office Park.
• Fluency in Polish and English.