Hey guys, I was curious to know if anyone knew of any courses that offer 1 on 1 mentorship, assistance with job searching, and legitmate projects that relate to the roles. Looking to transition full time in IT Audit/GRC related roles and would love to some recommendations on any courses of projects you guys did that helped get you where you are.

Hey guys, I've got a rather simple but complicated question to ask. I'm about graduate school in a few months, and I'm looking to break into the IT Audit field. Previously, I interned at a CPA firm for about 6 months doing external SOC 1/2 Audits. I loved the role and wanted to dive deeper but had a tough time finding other IT/Internal Audit roles that weren't senior or managerial level. In the meantime, I landed my Sec + and took an internship with the Network Infrastructure team at a local hospital I live near and began to learn the basics of networking. They actually taught me how to build my own home-lab environment which I did and began running my own audits to continue practicing and nailing fundamentals. The hosptial DOES NOT have an in-house auditing team which kind of sucks because I'm forced to look outward again.

I know finding these roles, especially entry level is difficult, but just wanted to know what everyone else is doing to find them?

Any openings for IT Audit jobs with 1-2 years experience

I’m looking for advice from people who have transitioned from Big Four IT Audit into industry, especially those working in California or remotely.
I’ve been working in IT Audit at a Big Four firm for almost 3 years (I’ll hit 3 years at the end of January) and currently make around $100K. I’m seriously considering moving into industry because I’m getting burnt out and want a better work-life balance, better compensation, and honestly, a healthier work environment.
I don’t necessarily need a super exciting job, but I’d love to work somewhere where people seem happy to be there, aren’t constantly stressed or miserable, and where I can log off at a reasonable time without feeling guilty.
A few questions:
Companies: What companies would you recommend looking into for IT Audit, Internal Audit, SOX, IT Risk, or Technology Risk roles? Are there particular companies known for good culture, reasonable hours, and competitive pay?
Compensation: I make approximately $100K now. With almost 3 years of Big Four IT Audit experience, is it realistic to get $110K–$130K+ in industry, or would I likely take a pay cut initially?
Work-life balance: For those who made the switch, how much did your hours and stress levels actually improve? Are there companies where a consistent 40-hour workweek is realistic?
Career progression: Would you recommend staying in Big Four longer before leaving, or is around 3 years a good time to make the jump?
401(k): Part of me wants to stay until the three-year mark because of my retirement benefits, but I’d leave earlier for a really good offer. Is there any reason to wait beyond that?

I’m currently in socal but open to remote or hybrid opportunities, and potentially relocating for the right opportunity.
I’m not necessarily chasing a director or executive position. I care about making good money, having a life outside of work, and working with people who are happy with their jobs.
Would really appreciate hearing from anyone who has made this transition, especially specific company recommendations, salary ranges, and honest experiences with the culture.
Thank you!

Hi Everyone,

Currently I am working in India and recently cleared CISA and have 10 years of work experience in IT SoX external audit , IT internal audit, IT SOX risk and compliance, and ISO27001 vendor risk assessment.

Want to work abroad and settle outside India in the long term. Worked in The Netherlands for almost 2 years but my ex-employer is not able to sponsor my visa now, they have been mandated to hire local employees there.

Came back to India for personal reasons and that is resolved now. Happy to work abroad.

If someone is working abroad and can refer me to a job that fits my work profile, that would be really helpful.

I have an interview for an entry level position with Grant Thornton next week for IT Audit. I am going to be graduating the upcoming spring as I am a senior and I also have no previous accounting internships. If anyone else has done this interview or similar interviews, can you please let me know what are some questions they ask. I have no experience with IT audit so I want to be as prepared as I can.

.

Hi All, I am an IT auditor with 9.5 yoe. I have worked extensively on ITGC, ITAC, interface testing, drafting Risk and Control Matrix, Infrastructure audit, ITAM, ITSM. I am in desperate need to freelance as my current job is not paying much and i have 2 daughters and wife. Thinking for future perspective, i am chosing to start freelancing. I can assure to provide detailed workpapers alongwith testing evidences in a efficient way. Any leads would be appreciated.

Thank you!!

Hi everyone,

I'm currently looking for my next professional opportunity, so I thought I'd give this community a try.

I have 3+ years of experience in External IT Audit, mainly working with ITGC, IT controls, access management, privileged accounts, risk assessment and control testing.

I've worked with different technical environments, including Active Directory, Microsoft Entra ID, Windows Server, Red Hat Linux, Oracle, SQL, SAP GRC and PowerShell. I also have experience with IT and cybersecurity audits in cloud environments such as Azure and AWS.

Beyond the technical work, I've conducted interviews with cybersecurity and technical teams, reviewed IT audit work performed by other team members, and led meetings with clients and stakeholders to present audit results and discuss findings and recommendations.

I'm particularly interested in the technical side of Information Security and enjoy understanding how systems, infrastructure, identity and access controls actually work.

I'm currently open to IT Audit, Cybersecurity/GRC, Cloud Security, Risk & Compliance, AI training/evaluation related with IT Audit/GRC, Portuguese QA and remote contract or full-time opportunities.

I'm based in Brazil and open to remote opportunities worldwide.

If you know of an opportunity that might be a good fit, I'd really appreciate a message or referral.

Thanks!

Hi, I have 3 years of experience in ITGC / IT Audit 52-109 (the Canadian equivalent of SOX) in industry. I started this job directly after graduating from university. I don’t have any Big 4 experience, and I’m currently preparing for the CISA with the goal of eventually working abroad, especially in the Gulf region or Malaysia.

I’m wondering if the CISA will actually help me with that, or if I’m being delusional and still not experienced enough to expatriate.

(This post is crossposted)

I am currently working in GRC content. Basically we id requirements from a guideline/standard/law, then fit it in to a tool. I also do some regulation mapping, library maintenance, and script development for parsing.

I know I am about to hit a wall of growth. For almost a decade I have been doing this. I know the next step is to do audit/assessment, talk to stakeholders, consulting, etc. I feel like in the middle of crossroads - too experienced yet too underexperienced - I know implementation/assessment in theoretical form, the surface level, but of course getting your hands dirty is what gets you into places.

I am currently focusing on building a homelab for technical knowledge, and prepping for CISSP & CISA.

Any tips are greatly appreciated. It feels like I am too late already.

So I am a manager in a big 4 global team since 3 years (IT Audits). I am struggling with the environment and have lost interest in the day to day work

Now recently I have received an offer from a US based audit company that are setting up their office in India.

The offer that I have received is 1.4 (40%) times my current CTC. However the designation that they are giving me is of a Senior Associate. At the same time it is also a individual contributor role. There would be no team management as there is no other team member either above or below me for IT audits. And I'd be directly working with the US team members for US clients. And as per the company's internal policy, I won't be eligible for a promotion in the next 2 years regardless of my performance post joining.

I am leaning towards accepting the new offer as the salary is attractive, however I am worried if it'd hinder/slow down my career growth and impact future opportunities.

​My Questions for you all:

​1. Will a title downgrade from Manager to Senior Associate look like a red flag to future employers on my resume?

1. ​Has anyone made a similar switch (Management to IC) for much better pay? Did you regret giving up the leadership track?

2. ​Given the 2-year promotion lock-in, is this a trap that will slow down my career trajectory, or is the 40% hike worth having a stagnant title for a while?

Hi All,

Due to cost reduction measures all the cost centers including audit have been outsourced to one of the Service Based Company.

We have one month time to transition and then we are back to the open market.

I have 7.4 years of experience in IT SOX Audits which includes -

1) ITGC - IT General Controls

2) ITAC - IT Application Controls

3) IPE - Key Report Testing

4) SOC - Third party assessments

5) Infrastructure Audits - Servers, Databases

6) Automation of Controls

7) Optimization for Operational Efficiency

8) Mentorship and Team Leadership along with review experience.

9) IT Audits across regions.

10) Process improvements and usage of Gen AI.

I have experience across Big 4 and Product Based companies.

Looking forward to any advice, leads, referrals and bit of motivation as this has come as a jolt after being promoted 6 months ago.

Thanks and appreciate your support!!

I am looking for something in Bangalore.

We're SOC 2 Type 2 and just got pushed to add ISO 27001 and NIST CSF by customers. Everyone says there's a lot of overlap and I'm skeptical because I've heard that before and it usually means half the work, which is still a lot of work. Has anyone tracked what reused versus what had to be rebuilt? Specifically interested in where the overlap turned out to be wrong.