IT Audit Manager, Internal Audit & Internal Controls

The IT Audit Manager, Internal Audit and Internal Controls exists to lead the ongoing maintenance, evaluation, and testing of the organization’s IT general controls (ITGCs), application controls, and IT security controls for the SOX, Model Audit Rule (MAR), and Internal Audit programs. This role is expected to play a critical part in the continuing evolution of the internal technology control framework while managing audit projects across cloud infrastructure, engineering, data platforms, and core business systems as part of the Internal Audit function.

Success is achieved by providing strong project management over technology audits, reviewing technical workpapers for external and audit report readiness, leveraging AI to perform data analytics and visualization, and educating cross-functional business and engineering partners on maintaining a robust, scalable control environment. The ideal candidate combines hands-on IT audit expertise, strong supervisory skills, and a deep understanding of information security, modern technology architecture, and risk management.

Root is a “work where it works best” company. Meaning we will support you working in whatever location that works best for you across the US. We will continue to have our headquarters in Columbus, Ohio.

How You Will Make an Impact

• Lead IT Audit & Compliance Project Management: Drive project management efforts for the implementation, testing, and continuous monitoring of Root’s IT General Controls (ITGCs), automated application controls, SOC 1 reviews, and IT-dependent reporting to support SOX and Model Audit Rule (MAR) compliance.
• Supervise & Guide Audit Execution: Lead and mentor IT auditors and cross-functional team members through complex technology processes, system implementations, and automated & manual controls.
• Review Workpapers & External Audit Liaison: Review IT audit workpapers to ensure alignment with professional standards, audit readiness, and seamless coordination with external auditors and regulatory examiners.
• Critical Technology Projects & System Launches: Partner proactively with engineering, product, and IT operations to ensure risk and control perspectives are assessed, designed, and implemented during critical business and technology initiatives.
• Stakeholder Collaboration & Education: Work collaboratively with the Head of Internal Audit and Internal Controls and technology process owners (including engineering, InfoSec, and IT) to effectively communicate the value of proactive risk management and strong internal controls.
• Issue Evaluation & Remediation: Collaborate with control owners to identify root causes, vet IT findings, evaluate year-end issue severity, and verify that effective, sustainable technical remediation is implemented.
• Reporting & Data-Driven Insights: Develop clear, concise audit reports and executive updates utilizing data analytics and visualization concepts to communicate audit results and IT risk exposures to leadership.
• Policy & Control Framework Evolution: Partner with the team to maintain and update IT internal audit standards, methodologies, testing procedures, risk and control matrices (RCMs), and process flowcharts.
• GRC System Utilization: Utilize the organization’s governance, risk, and compliance (GRC) tool (Optro) to facilitate end-to-end preparation, review, documentation, and tracking of IT audit workpapers and remediations.

What You Will Need to Succeed

• 5+ years of relevant experience in IT Audit, IT Risk and Compliance, Information Security, or Internal Audit (in-house or Big Four / public accounting equivalent).
• 2+ years of supervisory or team leadership experience.
• 2+ years of experience working in an Insurance, Technology, or InsurTech environment preferred.
• CISA, CIA and/or CPA are preferred.
• Solid knowledge of IT General Controls (ITGCs), Information Security, Change Management, System Development Life Cycles (SDLC), Logical Access, and Computer Operations.
• Familiarity with industry standards and regulatory frameworks, such as COSO, SOC 1 / SOC 2, SOX and/or NAIC Model Audit Rule.
• Experience auditing modern cloud architectures (e.g., AWS), SaaS ecosystems, and automated data pipelines.
• Analytical & Problem-Solving Capabilities: Highly analytical, with demonstrated experience leveraging data-driven insights and audit analytics to evaluate systems and prioritize risk.
• Project Management & Communication: Proven track record of managing multiple project timelines simultaneously, with exceptional written and verbal communication skills and the ability to influence technical and non-technical stakeholders without direct authority.

As part of Root's interview process, we kindly ask that all candidates be on camera for virtual interviews. This helps us create a more personal and engaging experience for both you and our interviewers. Being on camera is a standard requirement for our process and part of how we assess fit and communication style, so we do require it to move forward with any applicant's candidacy. If you have any concerns, feel free to let us know once you are contacted. We’re happy to talk it through.

Please see our Privacy Notice available HERE for more information on how we process your personal data.

Consistent with the Americans with Disabilities Act (ADA) and the Civil Rights Act of 1964, it is the policy of Root to provide reasonable accommodation when requested by a qualified applicant or candidate with a disability, unless such accommodation would cause an undue hardship for Root. The policy regarding requests for reasonable accommodation applies to all aspects of the hiring process. If reasonable accommodation is needed, please contact.