Senior Internal Auditor, Technology

The Team
Payward's Audit & Risk function operates as an Integrated Assurance organization, bringing together Internal Audit and Enterprise Risk Management under a unified risk oversight strategy. The function spans Internal Audit, SOX Compliance, and Enterprise Risk Management across multiple regulated entities and jurisdictions. Internal Audit partners with co-sourced providers, maintains direct reporting lines to the Global and Local Audit Committees, and is building a technology-forward assurance capability at the forefront of crypto and financial innovation.The opportunity
You'll partner with Internal Audit leadership to execute the technology audit program, evaluating the design and operating effectiveness of controls across a broad IT environment - cybersecurity, identity and access management, the software development lifecycle, data and privacy, operational resilience, and AI. This is a hands-on role with real ownership over scope, stakeholders, and outcomes - you'll shape how safely Payward manages some of the highest-risks it carries. You'll be doing it at a crypto exchange - where the infrastructure spans blockchain-native systems and digital asset custody, deployment cycles are fast, and client trust depends on getting the controls right. If you want technology audit work where the systems are genuinely complex and the stakes matter, this is it.Responsibilities span the following areas:Technology audit executionPlan and execute technology audits across a broad IT environment - cybersecurity, cloud, identity and access management, the software development lifecycle (SDLC) and change management
Assess the security of core systems holding sensitive customer records and identity documentation - access controls, data protection, monitoring, and regulatory and policy compliance
Assess operational resilience (business continuity, disaster recovery, and resilience testing), incident management, technology risk management, and third-party technology oversight
Review data governance, privacy, and data-lake controls, and assess AI governance, security, and privacy across the organization's use of AI and machine-learning systems
Test the design and operating effectiveness of IT general controls and application controls against frameworks such as ISO 27001, NIST CSF, SOC 2, or COBIT;
identify gaps, perform root cause analysis, and assess business and financial-reporting impact
Apply AI-enabled workflows - AI-assisted testing, anomaly detection, and analytics - to expand coverage and efficiency, with human ownership of conclusions
Engagement & issue managementLead multiple audit engagements concurrently, managing planning, fieldwork, and reporting end-to-end
Document audit findings, including control gaps and root cause, and draft clear, well-supported workpapers and reports
Track and validate remediation of identified issues, escalating delays or gaps to Internal Audit leadership
Contribute to the continuous improvement of audit methodologies and frameworks, and ensure conformance with the IIA Global Internal Audit Standards and the function's quality assurance requirements
Lead engagement teams, including staffing and coordinating co-sourced specialists, to ensure quality and timely delivery across audits
Stakeholder engagement & reportingServe as a trusted point of contact for control owners across Engineering, Infrastructure, and Security teams to communicate audit results and advise on control improvements, while maintaining audit independence
Translate technical findings into clear, actionable conclusions for non-technical stakeholders and senior leadership
Partner with other Internal Audit team members and co-sourced resources to ensure coordinated coverage across the audit plan
What you bring
5-8 years in IT audit, information security, or a related technology risk function, ideally within financial services, fintech, or crypto
Broad IT audit experience across several of: cybersecurity, identity and access management, ITGCs, cloud, SDLC and change management, data and privacy, operational resilience, and third-party technology risk
Strong grasp of control frameworks (ISO 27001, NIST CSF, SOC 2, or COBIT) and cloud environments (AWS, GCP, Azure)
Working knowledge of data governance and privacy (e.G., GDPR), with exposure to AI governance, security, and privacy
Technically fluent with enterprise technology (systems, databases, deployment pipelines) and able to translate findings clearly for engineers and senior leaders alike
Applies generative AI responsibly, with human oversight, to improve testing coverage and efficiency
Nice to haves
Relevant certifications: CISA, CISSP, CRISC, CIA, or equivalent
Familiarity with blockchain infrastructure, digital asset custody, or crypto-native technology environments
Experience with CI/CD pipelines, version control, and modern deployment practices.
Exposure to operational resilience and ISO 27001 certification environments
Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis.Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution.We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance.Our commitment
We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision.
As an equal opportunity employer, we don't tolerate discrimination or harassment of any kind, whether based on race, ethnicity, age, gender identity, citizenship, religion, sexual orientation, disability, pregnancy, veteran status, or any other protected characteristic as outlined by federal, state, or local laws.
#J-18808-Ljbffr