IT Audit Director

Job Description

The Director leads Aramark’s IT SOX program and a risk-based portfolio of technology audits covering enterprise applications, infrastructure, cybersecurity, cloud and SaaS platforms, third-party technology, and major system implementations. The role leads a team of Senior IT Auditors and IT Auditors, serves as Internal Audit’s primary IT contact for the external auditor, and builds trusted working relationships with technology and business leaders. The Director also helps advance the team’s use of data analytics, automation, and approved AI to improve audit coverage and quality. Compensation will be competitive and commensurate with experience.

Job Responsibilities

• Lead the IT SOX program and a portfolio of technology audits across applications, databases, operating systems, and infrastructure. Coordinate assignments, monitor progress, and manage budgets and schedules.
• Lead or oversee audits of IT general controls, identity and access management, change management, cybersecurity, data privacy, technology resilience and disaster recovery, and cloud services.
• Contribute to the annual risk assessment and Annual Audit Plan, and own the IT SOX scope and technology audit plan within it. Using a risk-based approach, set audit scope and objectives, review and finalize audit reports, and communicate findings with practical, cost-effective recommendations.
• Review workpapers and reports prepared by Senior IT Auditors and IT Auditors before final leadership review. Maintain technology audit methodology and workpaper standards to support consistent, high-quality deliverables. Coach and develop team members through regular feedback, and support recruiting and retention.
• Serve as point of contact for audit business partners and stakeholders; assume responsibility for relationship management for specific business areas. Work in partnership with business leaders to strengthen governance, risk, and control environments by anticipating issues, providing advice, and sharing Internal Audit knowledge and best practices.
• Serve as Internal Audit's primary IT contact for the external auditor. Manage IT SOX reliance timelines, PBC escalations, deficiency evaluation, and year-end evidence quality.
• Own SOC 1/SOC 2 coverage for in-scope service organizations, including fiscal-year alignment, bridge letters, CUEC mapping, and alternative procedures when reports are unavailable.
• Provide independent risk input on system implementations and ERP selections (SDLC, data conversion, access, testing evidence, go-live readiness). Frame SOX and system-of-record impacts for management without assuming control ownership.
• Advise control owners on ownership, wording, and design of automated and access controls, including international entities.
• Administer issue tracking, remediation follow-up, and reporting in Riskonnect; validate that management action plans are completed and sustained.