About Us
At ControlSage, we help fast-growing companies turn compliance from a bottleneck into a competitive advantage. Our managed compliance platform combines AI-powered automation with hands-on expert guidance to help startups and scaleups achieve and maintain SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, and other critical certifications without slowing down engineering.
Our team includes security engineers, compliance experts, and former auditors who care about solving real problems for real businesses. Whether you're mapping controls, closing an audit, or building a governance program from scratch, your work here directly determines whether our customers can close their next enterprise deal.
The Role
We're looking for an IT Audit Manager to lead internal and external audit engagements across our compliance frameworks. You'll manage the planning, execution, and reporting of IT audits, working closely with Engineering and Compliance to test controls and validate that our systems meet the standards our customers require. This role is ideal for someone who can both dig into the technical details and manage a program at scale.
Key Responsibilities
Plan and lead IT audit engagements across SOC 2, ISO 27001, PCI DSS, and other frameworks
Design and execute control testing procedures, including walkthroughs and evidence sampling
Manage relationships with external auditors and serve as the primary point of contact during audits
Identify control deficiencies and partner with Engineering to drive timely remediation
Build and maintain audit workpapers, testing documentation, and control matrices
Lead internal audit reviews to proactively identify gaps before external assessments
Mentor and provide guidance to junior compliance and audit staff
Present audit findings and status updates to leadership and key stakeholders
Continuously improve audit methodology and tooling to increase efficiency
Requirements
5+ years of IT audit, internal audit, or information security compliance experience
Hands-on experience leading SOC 2 and/or ISO 27001 audit engagements
Strong understanding of IT general controls (ITGCs) and control testing methodologies
Experience managing relationships with external auditors and assessors
Excellent written communication skills for documenting findings and audit workpapers
Strong project management skills with the ability to manage multiple concurrent audits
Comfortable presenting findings to technical and executive audiences
Willingness and curiosity to use modern AI tools to build simpler, faster ways to track and report data.
Preferred Qualifications
CISA, CIA, or CISSP certification
Experience auditing cloud-native environments (AWS, GCP, or Azure)
Prior experience at a public accounting firm or in a Big 4 audit practice
Salary Band
$110,000 - $150,000 USD. Our salary bands are structured based on a combination of geographic tiers and internal leveling. Compensation is determined by multiple factors assessed during the interview process, with the final offer reflecting these considerations.
Company Perks
Hubs in San Francisco and Texas offering regular in-person gatherings and co-working sessions
Flexible PTO with U.S. holidays observed and a week shutdown in December to rest and recharge*
Equity plan ( Launchin soon)
$500 work-from-home stipend to be used within a year of your start date*
$1,200 per year Health and Wellness Allowance to support your personal goals*
The chance to collaborate with a team at the forefront of compliance and AI-powered governance
*Certain perks and benefits are limited to full-time employees only.
ControlSage participates in E-Verify. We will provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's Form I-9 to confirm work authorization. We are also an inclusive, equitable, and accessible workplace. Please let us know if you require accommodation for any portion of the recruitment and hiring process.
Beware of recruiting scams: ControlSage will only contact you through official @controlsage.com email addresses and will never ask for payment or sensitive personal information during the hiring process.