Junior Information Systems Auditor

Most days are a mix of evidence-pulling, control-testing, and documentation. You'll often spend the morning requesting system samples from IT contacts (user lists, change tickets, backup logs), the middle of the day walking through controls or interviewing process owners, and the afternoon writing findings into the workpaper system. Senior auditors usually scope the engagement; you execute the assigned procedures.

What's harder than people expect is the dual fluency required — enough IT to ask informed questions, enough audit to understand why a finding matters financially. Variance is large between public accounting firms (SOX ITGC work, multiple clients per year) and internal audit at a single company (deeper system familiarity, longer engagements). CISA tends to be the first major credential people pursue.

People who tend to thrive here are methodical, comfortable with technical-sounding evidence, and willing to learn enough about IT to push back when something doesn't add up. If you want to build systems, this role can feel like watching the build from the sidelines. If you find satisfaction in verifying that the technology supporting financial reporting actually works as claimed, the work tends to be steady and credential-friendly.