Senior Information Systems Auditor (Is Auditor)

Most weeks involve leading audit work, exercising senior-level judgment, and engaging across audit and IT communities. You'll often own scope decisions on integrated audits, make judgment calls on the materiality and severity of findings, coordinate findings remediation with IT and security leadership, and contribute to audit committee or client communications. The role increasingly involves audit-strategy contributions.

What's harder than people expect is the senior judgment dimension — at this level, your conclusions on whether a control is effective, whether a finding is significant, and how to frame remediation expectations carry real weight. Variance is meaningful between internal audit functions (broader scope, integrated audit programs, deeper relationships with one organization), public accounting practices (often more SOX/SOC-focused, multi-client exposure), and specialized IT audit consulting (often supporting M&A, regulatory examinations, or transformations). CISA remains the anchor; CIA, CISSP, or CISM shape advancement paths.

People who tend to thrive here are technically credible, comfortable with senior judgment, and patient with cross-community translation. If you want pure technical engineering, the audit posture continues to feel administrative. If you find satisfaction in being the senior IT auditor whose conclusions actually shape technology risk decisions, the work tends to lead into IT audit director, audit committee advisor, or technology risk leadership roles.