Senior Information Systems Auditor

A typical engagement cycle involves leading planning, executing complex testing, and managing reporting. You'll often own IT general controls testing across change management, access management, computer operations, and security; coordinate with financial auditors who depend on IT control results; review junior auditors' work; and present findings to managers, partners, or audit committees. The role tends to deepen toward integrated audit at this level.

What's harder than people expect is the cross-functional translation work — financial auditors don't always understand technology, IT teams don't always speak audit, and learning to work effectively across both takes years. Variance is significant between Big Four (SOX-heavy, multiple clients per year), regional firms (broader exposure, more autonomy), and internal audit (one organization, integrated risk programs). CISA is foundational; CIA, CPA, or specialty credentials shape next steps.

People who tend to thrive here are technically credible across IT and audit, patient with documentation, and comfortable bridging multiple communities. If you want pure technical work, the role can feel administrative. If you find satisfaction in owning the audit perspective on the technology supporting financial reporting, the work tends to lead into senior audit roles, IT risk leadership, or specialized GRC consulting.