Audit Manager, Information Security & Risk Management

Grant Thornton Global Delivery Center Poland is looking for an Audit Manager to join their Information Security and Risk Management team, supporting the design, implementation, and maintenance of an information security governance, risk and compliance program. The role involves managing internal and external audits and collaborating across teams in a global setting.

• Experience with information security frameworks and industry standards such as NIST 800-53, ISO 27001, 27017, COSO, HITRUST.
• Knowledge of regulatory requirements including GDPR.
• Experience performing IT audits and control testing.
• Experience using GRC tools and technologies.
• Ability to identify weaknesses in security controls.
• Expertise in security control design, implementation, and monitoring.
• Demonstrated experience across multiple information security domains.
• Bachelor's degree in Computer Science, Engineering, or related field or equivalent experience.
• Preferred certifications: CISA, CRISC, CISM, CISSP.
• Advanced verbal and written communication skills.
• Excellent organization and self-motivation.

• Develop audit programs and plans, determine audit scopes, and manage audit engagements.
• Oversee audit processes, make policy recommendations, and ensure compliance obligations are met.
• Coordinate and perform audit work, review audit reports and management responses.
• Identify deficiencies and provide practical recommendations and corrective action plans.
• Support iterative review of assessment results with stakeholders.
• Follow up on implementation of corrective actions.
• Identify and manage new compliance requirements from changes in standards (ISO 27001, SOC 2, NIST 800-53, GDPR).
• Participate in annual policy reviews.
• Educate control owners on risk submissions and support risk assessments.
• Design automated and manual control testing methods.
• Conduct compliance assessments and internal control testing of critical business processes and information systems.
• Facilitate policy operationalization and provide meaningful feedback.
• Establish and maintain effective relationships with control owners and operators.
• Support and advise control owners to build compliance-by-design and security-by-design programs.
• Promote proactive evidence collection for audits using GRC Tools.
• Validate evidence sufficiency and support remediation of findings.
• Create collateral to promote a culture of compliance aligned with firm risk tolerance.
• Contribute to development of scalable models and tools for decision making.
• Assimilate audit data into reports and dashboards for leadership.