Information Systems Auditor

Most days tend to involve controls testing, system walkthroughs, evidence collection, and findings documentation. You'll often test user access reviews, change management approvals, batch job controls, backup verification, and application-specific controls — producing findings that feed SOX certifications, audit reports, or compliance attestations. Engagement cadence varies by employer and scope.

The variance between settings is real — internal audit at a public company runs heavily on SOX IT general controls; external audit IT teams at public accounting firms support financial audit engagements; consulting firms deliver SOC 1, SOC 2, and other attestations; financial services audit covers banking-specific systems and regulatory expectations. Technical fluency with cloud, ERP, and infrastructure matters increasingly.

People who tend to thrive here are comfortable with technical depth, patient with audit documentation rigor, and effective communicating findings to both IT and business stakeholders. CISA credential is the dominant signal. The work tends to offer strong demand and clear career ladders toward IT audit manager, director, or CISO-adjacent paths, with the trade-off being the constant catch-up as technology evolves — for those who enjoy the rigor-meets-tech intersection, the work has durable appeal.