Information Systems Auditor

Requisition 39919: B3 - Information Systems Auditor (IT Talent Needed)

A resume helps you stand out to hiring managers and recruiters; your resume communicates your experience and your brand. While it is not required, we encourage you to include an up-to-date resume along with a completed job application to give you the best opportunity to be considered. A complete resume helps us to better understand your unique background, relevant experiences, and passions. We look forward to learning about you.

Norfolk Southern offers a unique opportunity to be part of our proud legacy that spans nearly 200 years. We are a customer-centric, operations-driven team dedicated to advancing safety, serving communities, and driving innovation for tomorrows rail. As part of Norfolk Southern, you'll join a collaborative team where there are opportunities for growth across the organization. We are building a culture where everyone can thrive by owning and driving exceptional results, being humble and leading with trust, serving our customers with excellence, and collaborating and coaching to win.

Primary Purpose

The Information Systems Internal Auditor (IS Auditor) provides independent assessments of the control environment over IT infrastructure, systems, and data through the execution of risk analysis, control evaluation, and innovative audit testing procedures. The IS Auditor focuses on the secure and effective deployment and operation of technology in support of corporate objectives and regulatory requirements. The IS Auditor builds and cultivates effective business relationships while providing independent value-added audit and advisory services. IS Auditor activities include developing risk-based audit programs, identifying recommendations that help mitigate risks and provide continuous improvement in processes and controls, communicating results, and following up on issues reported.

Principal Duties

• Participates in risk analysis, control identification, and the detailed development, execution and communication of the risk-based audit plan.
• Independently performs assigned audit testing and concludes on the effectiveness of controls, identifying control gaps and exceptions and evaluating the potential impact.
• Verifies the adequacy of IT procedures for the company through a systemic program of audits.
• Demonstrates the ability to multi-task, by clearly documenting the results of testing on more than one audit concurrently.
• Completes audit work, including audit work plan, work papers, findings, and associated reports.
• Prepares audit reports and work papers to ensure adequate documented evidence exists to support audit opinions and conclusions.
• Conducts IT integrated audits with operational, compliance, financial, and investigative audit teams, as assigned.
• Accurately interprets collected evidence to effectively Identify, recommend, and report improvement opportunities for processes and controls.
• As appropriate, identifies opportunities for continuous improvement related to the use of technology.
• Manages auditee relationship, including facilitating meetings, discussions of findings, and presenting draft and final reports in a professional manner.
• Prepares well-written and timely audit reports which communicate audit issues and related recommendations in both technical and non-technical terms to management.
• Effectively communicates audit issues and related recommendations in both technical and non-technical terms to management.
• Demonstrates development in technical and analytical skills to understand new and existing technologies, including Cyber Security, IT General Controls and Software Development Practices.
• Demonstrates technical understanding of data analysis concepts and practices.
• Keeps abreast of company policies and procedures, current developments in technology and auditing professions, and regulatory changes.
• Develops an awareness of changes in IT audit practices, regulatory requirements, and IT Risk frameworks to understand their impact to Auditing. (e.g. NIST, COBIT, ISO, etc.)

Job Related Experience

Minimum Level: 1 year

Preferred Level: 3-5 years

Education

Required Level: Bachelors Degree (BA, BBA, BS)

Preferred Majors: Computer Science, Information Systems, Cybersecurity, Accounting Information Systems, Internal Auditing.

Skills Required

• 1 year experience and/or exposure to internal information systems audit, risk, or compliance.

Skills Preferred

• 3-5 years experience in Internal Audit with a focus on information systems.
• Broad IT knowledge in infrastructure technologies, application development and support, and emerging technologies in one or more of the following areas:

o IT General Controls (ITGCs) access, change management, and operations

o Cybersecurity Controls identity & access management, data protection, security monitoring

o Application Lifecyle Controls key system controls supporting business processes

o Data Analytics & Audit Testing data extraction, validation, and risk-based analysis

o IT Risk & Control Frameworks NIST, COBIT, COSO alignment

o Systems & Infrastructure ERP (SAP), databases, operating systems, and networks

o Business Continuity & Disaster Recovery (BCP/DR) resiliency and recovery capabilities

Licenses / Certications

Required: None listed

Preferred:

• Certified Information Systems Auditor (CISA)
• Certified Information Systems Security Professional (CISSP)
• Certied Internal Auditor (CIA)

Skills and Abilities

• Communication Skills
• Time Management
• Analyzing Problems
• Agile Learner
• Adaptive Thinking

Career Path

Predecessor Jobs:

• Staff Auditor

Future Jobs:

• Sr. Internal Auditor
• Manager of Information System Audits
• Director of Audits
• Various other management opportunities

Work Conditions

Environment: Hybrid (3) days on-site and (2) remote work per week

Shift Work: No; as needed

On-Call: No

Weekend Work: No; as needed

Travel Required: as needed

Company Overview

Since 1827, Norfolk Southern Corporation (NYSE: NSC) and its predecessor companies have safely moved the goods and materials that drive the U.S. economy. Today, it operates a customer-centric and operations-driven freight transportation network. Committed to furthering sustainability, Norfolk Southern helps its customers avoid 15 million tons of yearly carbon emissions by shipping via rail. Its dedicated team members deliver more than 7 million carloads annually, from agriculture to consumer goods, and is the largest rail shipper of auto products and metals in North America. Norfolk Southern also has the most extensive intermodal network in the eastern U.S., serving a majority of the country's population and manufacturing base, with connections to every major container port on the Atlantic coast as well as the Gulf of Mexico and Great Lakes. Learn more by visiting www.NorfolkSouthern.com.

At Norfolk Southern, we believe in celebrating our individuality. By leveraging the unique backgrounds and viewpoints of our employees, we can create a culture of innovation, respect, and inclusion. We know that employees thrive in a workplace where differing viewpoints, ideas, and experiences are freely shared and valued. As such, we encourage all employees to contribute their distinctive skills and capabilities to our organization.

Equal employment opportunities are available to all applicants regardless of race, color, religion, age, sex, national origin, disability status, genetic information, veteran status, sexual orientation, and gender identity. Together, we power progress.