SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
OpenLoop is a telehealth platform enabling virtual care delivery across all 50 states. The company is seeking a Senior IT Audit Manager to lead its IT controls audit program, reporting to the Head of Internal Audit.
In this role, you will own the full IT audit lifecycle in a rapidly scaling, heavily regulated healthcare environment preparing for significant growth. You will develop and execute a risk-based IT audit plan covering IT general controls (ITGC), cybersecurity, data privacy, cloud infrastructure, EHR/EMR systems, and emerging technology controls. Key responsibilities include:
- Developing and maintaining a risk-based IT audit plan with periodic IT risk assessments across systems, applications, and infrastructure
- Leading end-to-end IT audit engagements from planning through fieldwork, reporting, and issue closure
- Designing and executing IT control testing procedures independently, including ITGC testing (access management, change management, computer operations, SDLC)
- Assessing cybersecurity controls (network security, identity and access management, vulnerability management, incident response)
- Evaluating cloud infrastructure controls (AWS, Azure, GCP) for security, reliability, and regulatory compliance
- Conducting audits of EHR/EMR systems and clinical application controls; assessing data privacy controls for HIPAA, CCPA, and state-level compliance
- Supporting AI governance frameworks and controls, including model governance, data quality, and bias risk assessment
- Preparing IT audit documentation (process narratives, flowcharts, risk and control matrices, testing workpapers, reports)
- Partnering with management to design, remediate, and validate controls with practical, prioritized recommendations
- Tracking open IT audit issues and remediation plans through closure
- Monitoring evolving IT risk, cybersecurity, and regulatory landscape to keep the audit plan current
You will work in a flat organizational structure with autonomy, competence, and belonging as core values. The role offers hybrid-work flexibility, competitive compensation, medical/dental/vision, FSA/HSA, generous PTO, 401(k) match, and life/pet insurance.
REQUIREMENTS:
- Bachelor's degree in Information Systems, Information Technology, Computer Science, or equivalent technical field
- Active Certified Information Systems Auditor (CISA) designation
- 7+ years of progressive IT audit experience in business risk advisory consulting or internal audit IT specialization
- Demonstrated hands-on experience with IT general controls (ITGC) testing (access management, change management, computer operations, SDLC)
- Strong knowledge of IT governance and control frameworks (COBIT, COSO, NIST 800-53, ISO 27001) and ISACA IT audit standards
- Demonstrated experience auditing cybersecurity and cloud infrastructure controls (network security, IAM, vulnerability management, incident response, AWS/Azure/GCP)
- Familiarity with HIPAA Security Rule requirements (technical safeguards, risk analysis, security incident procedures)
- Experience auditing application controls across SaaS platforms and regulated healthcare technology environments (EHR/EMR systems) with hands-on testing of input, processing, output controls, data integrity, and access controls
- Demonstrated use of AI tools to enhance audit execution and control testing
- Ability to execute IT audit engagements independently, manage multiple concurrent engagements, and deliver on time without close supervision
- Clear, concise written and verbal communication skills; ability to translate complex technical findings into practical recommendations for IT and non-IT audiences
PREFERRED:
- Public accounting background (Big 4 or regional firm) with IT audit or technology risk advisory focus
- Additional certifications (CRISC, CISSP, CISM, CIA)
- Prior experience supporting SOX ITGC compliance in pre-IPO, newly public, or high-growth company environments
- Experience auditing or assessing AI governance frameworks (model governance, data quality controls, emerging AI regulations)
- Familiarity with data privacy frameworks beyond HIPAA (CCPA, state-level regulations)
- Knowledge of DevOps practices and SDLC security controls for software development and deployment pipelines
- Proficiency with GRC platforms (AuditBoard, Workiva, Vanta)
- Experience in digital health, telehealth, or multi-state healthcare services environments
