Senior Auditor - IT Systems and Controls

Job description

Lambda, The Superintelligence Cloud, is a leader in AI cloud infrastructure serving tens of thousands of customers. Our customers range from AI researchers to enterprises and hyperscalers. Lambda's mission is to make compute as ubiquitous as electricity and give everyone the power of superintelligence. One person, one GPU. If you'd like to build the world's best AI cloud, join us. Note: This position requires presence in our San Jose or San Francisco office location 4 days per week; Lambda’s designated work from home day is currently Tuesday. What You’ll Do We are seeking an experienced Senior Auditor - IT Systems and Controls to join our Internal Audit function, reporting to the Internal Audit Lead - IT Systems and Controls. You will independently execute IT SOX testing for your assigned systems, review testing performed by co-sourced or junior team members, and be a credible, experienced voice with engineering, IT, and security teams across Lambda’s homegrown platform and third-party SaaS applications. - SOX IT Controls & Assurance - Plan, execute, and document SOX testing for IT General Controls (ITGCs), IT Automated Controls, and Key Reports across assigned in-scope systems, exercising independent judgment on complex or ambiguous control questions. - Contribute to the annual IT SOX scoping and risk assessment process for assigned systems, in alignment with the overall ICFR and SOX program. - Conduct walkthroughs and design/effectiveness testing of IT controls across homegrown and third-party systems, engaging directly with control owners and engineering leads. - Review the testing work of co-sourced resources or junior team members for quality, completeness, and adherence to methodology. - Coordinate evidence collection and remediation efforts, holding process and system owners accountable to agreed timelines. - Identify control deficiencies, evaluate severity and root cause, and partner with engineering and IT management to design and validate effective remediation. - Maintain ICFR/SOX 404 documentation for assigned areas, including COSO framework mapping, process and control narratives/flowcharts, risk and controls matrices, and testing approach. - Apply professional skepticism to independently evaluate and conclude on control design and operating effectiveness. - IT & Data Assurance Projects - Execute internal audit and advisory projects focused on IT, data governance, and emerging technology risk, with a primary focus on internal controls over financial reporting. - Advise technology and business stakeholders on IT risk management and control optimization for their assigned area. - Evaluate data integrity, system development practices, access management, and change management processes across homegrown and third-party systems. - Partner directly with engineering and IT teams to design practical, scalable controls that fit a fast-moving codebase and infrastructure. - Control Evaluation & Remediation - Assess the severity and impact of control deficiencies, including evaluation of aggregation and compensating controls. - Work with engineering and IT process owners to develop, track, and validate remediation plans on time. - Recommend process improvements and efficiency opportunities while maintaining control effectiveness. - Stakeholder Collaboration - Serve as the day-to-day point of contact for IT, Engineering, and Security teams on IT SOX and assurance activities for assigned systems. - Support external auditors during IT SOX testing for assigned systems, providing evidence, walkthroughs, and context as needed. - Provide guidance to IT and business stakeholders, and informal coaching to co-sourced or junior team members, on IT control requirements and leading practices. - Reporting & Communication - Prepare clear, well-organized workpapers and status updates on testing results and remediation progress for the Internal Audit Lead and Head of Internal Audit, including materials to support their Audit Committee reporting. - Translate technical IT control issues into business-relevant language for non-technical stakeholders. - Monitor industry and regulatory developments relevant to assigned systems, flagging emerging risks to the Internal Audit Lead. You - Education & Certification - Bachelor’s degree in Information Systems, Computer Science, Accounting, or related field. - CISA strongly preferred; CISSP, CPA, or CIA a plus. - Experience - 8+ years of progressive experience in IT audit, IT risk, or IT SOX compliance, at a level equivalent to Manager at a Big Four accounting firm, or an internal audit professional with comparable scope and seniority in industry. - Big Four accounting firm or equivalent experience in Internal or External Audit or IT consulting practice, including experience reviewing and directing the work of junior staff. - Deep expertise in ITGCs, IT Automated Controls, key report testing, and their relevance to ICFR, internal audit methodology, and IIA standards. - Experience independently leading audits of both homegrown business systems and third-party SaaS applications. - Demonstrated experience in data governance, system implementation reviews, and cybersecurity risk assessments. - Experience working with audit management tools (e.g., AuditBoard, Archer, Workiva) to manage SOX and IT compliance programs. - Skills & Competencies - Strong analytical and technical skills with the ability to independently evaluate IT and data risks across complex environments. - Excellent communication and interpersonal skills to effectively engage with, and influence, both technical and non-technical senior stakeholders. - Proven ability to review and quality-check the work of junior team members or co-sourced resources, even without formal direct reports. - Organized, detail-oriented, and able to manage multiple concurrent engagements in a dynamic, fast-growth environment with minimal oversight. Nice to Have - Experience with data analytics and automated testing tools (e.g., SQL, Python, ACL, Power BI) to enhance SOX testing efficiency and insights. - Exposure to emerging technologies such as cloud computing, cybersecurity, and RPA, and their control implications. - Prior experience working in a fast-growth or pre-IPO organization, building or scaling a SOX program ahead of public-company readiness. - Familiarity with cybersecurity frameworks (e.g., NIST, ISO 27001, COBIT) and their application to IT risk management. - Experience auditing engineering practices such as GitHub-based change management, CI/CD pipelines, or internally managed databases. - Prior involvement in system implementation or upgrade reviews for ERP, financial systems, or homegrown applications. - Experience presenting findings to senior leadership or an Audit Committee. Salary Range Information The annual salary range for this position has been set based on market data and other factors. However, a salary higher or lower than this range may be appropriate for a candidate whose qualifications differ meaningfully from those listed in the job description. About Lambda - Founded in 2012, with 500+ employees, and growing fast - Our investors notably include TWG Global, US Innovative Technology Fund (USIT), Andra Capital, SGW, Andrej Karpathy, ARK Invest, Fincadia Advisors, G Squared, In-Q-Tel (IQT), KHK & Partners, NVIDIA, Pegatron, Supermicro, Wistron, Wiwynn, Gradient Ventures, Mercato Partners, SVB, 1517, and Crescent Cove - We have research papers accepted at top machine learning and graphics conferences, including NeurIPS, ICCV, SIGGRAPH, and TOG - Our values are publicly available: https://lambda.ai/careers - We offer generous cash & equity compensation - Health, dental, and vision coverage for you and your dependents - Wellness and commuter stipends for select roles - 401k Plan with 2% company match (USA employees) - Flexible paid time off plan that we all actually use Equal Opportunity Employer Lambda is an Equal Opportunity employer. Applicants are considered without regard to race, color, religion, creed, national origin, age, sex, gender, marital status, sexual orientation and identity, genetic information, veteran status, citizenship, or any other factors prohibited by local, state, or federal law.