IT Auditor

Overview

American Credit Acceptance (ACA) is seeking an IT Auditor to join our dynamic Internal Audit team. The successful candidate will perform and execute the annual internal audit plan of IT, operational, field, compliance, regulatory, and investigative audits to ensure the reliability and integrity of information, compliance with policies and regulations, the safeguarding of assets, the economical and efficient use of resources, and established operational objectives of American Credit Acceptance.

This responsibility includes performing IT audit procedures and preparing internal audit reports reflecting the results of the work performed. The candidate will be involved with all facets of Information Technology and Information Security and must be able to clearly articulate technical-related risks to technical and non-technical members of executive management.

This is an on-site role based out of our Corporate office in Spartanburg, SC.

• Perform risk-based/security audits in areas including, but not limited to, applications (internal & external facing), databases, operating systems, network, sensitive data, patch management, change management, BCP/DR, third-party, cloud, etc.
• Performs work under direct supervision.
• Interact with external audit firms and provide guidance and support for audit engagements.
• Effectively executes test procedures and concludes on the operating effectiveness of relevant controls through the development of formal reports.
• Leverages appropriate resources for planning the audit engagement and effectively leads interviews/meetings to ensure relevant information is obtained for analysis.
• Performs an appropriate level of testing based on the scope and risk, without over- or under-auditing.
• Produces work paper documentation that is clear and concise, provides adequate detail of work performed and conclusions reached, meets department and professional standards, and is sufficient to receive a satisfactory rating from reviewers.
• Communicates obstacles or problems as they are encountered throughout the audit.
• Identifies control issues and findings timely and ensures findings are based on relevant facts and are accurately characterized (based on risk).
• Clearly communicates control findings to Internal Audit Management as they are identified.
• Working with ACA's external auditors to coordinate IT coverage across areas of responsibility and ensure that audit work is comprehensive and sufficient to allow the external auditors to rely on the work.
• Challenges the 'status-quo' and brings original ideas to the team.
• Fosters a team environment, is inclusive, and works well with others.

• Bachelor's degree in a related field required (e.g., Computer Science, Management Information Systems, Accounting).
• CISA, CISSP, CISM, or plans to pursue other relevant certification preferred.
• 0-2 years of relevant experience preferred.
• Business risk awareness and appropriate judgment to use a risk-based approach while executing the audits.
• High level of tact and ability to communicate complex and potentially sensitive issues to various levels of management – both within ACA's IT functions and outside to key non-technical business personnel.
• Can conform to shifting priorities, demands, and timelines through analytical and problem-solving capabilities.
• Must possess excellent communications skills (written and oral).
• Excellent presentation, relationship building, and interaction skills.
• Must possess strong computer skills (MS Word, Excel, Access, and Power Point).
• Must be able to think analytically, independently, and objectively.
• Must have working knowledge of tools & technical processes including identity & access management, database management; software development and quality assurance methodologies, change management, vulnerability management, penetration testing, data loss prevention, batch processing, business continuity/disaster recovery planning; enterprise architecture, telecommunications, data center operations, etc.
• Must have working knowledge of Application Software (internal & external facing), Storage Systems (SAN, NAS, and Data Warehouse), Databases (SQL), OS (Windows/Linux), Client-Server Systems, OSI, TCP/IP, LAN/WAN, Wireless Networks, Cloud Computing Systems, Microsoft Azure, Amazon Web Services (AWS), Active Directory, Microsoft Office 365, Virtualization, etc.
• Understanding of IT control frameworks (COBIT, ISO 27002, NIST, ITIL, etc.) is a plus.
• Knowledge of SOX 302/404, SSAE 16/SOC1/2/3, PCI, and/or GLBA is a plus.