We are seeking an experienced IT Controls Testing Specialist to plan, execute, and oversee the assessment of General IT Controls (ITGCs) across complex technology environments in the US firm and global member firms to support an assessment of our system of quality management. This role is responsible for evaluating the design and operating effectiveness of key SQC responses related to user access, change management, computer operations, interfaces, and system development lifecycle processes.

The ideal candidate is detail-oriented, risk-aware, and comfortable operating across both technical and control-focused discussions. They should be able to translate complex IT processes into practical control assessments and provide credible, actionable recommendations to improve compliance and reduce risk.

The individual will work closely with technology, business, risk, compliance, and audit stakeholders to identify gaps, assess risk, support remediation, and enhance the overall system of quality management. Depending on level, the role may include increasing responsibility for project management, team leadership, stakeholder management, quality review, and strategic oversight.

Work you’ll do

• Perform and/or oversee testing of IT general responses across key systems, applications, infrastructure, and platforms.
• Evaluate the design and operating effectiveness of responses related to:
• User access management
• Privileged access
• Segregation of duties
• Change management
• IT operations and job monitoring
• Backup and recovery
• Interface controls
• Incident and problem management
• Develop testing strategies, test plans, workpapers, and documentation aligned to internal methodologies and regulatory requirements.
• Lead walkthroughs with response owners and technology teams to understand processes, risks, and activities.
• Identify potential deficiencies, support assessment of severity and impact, and communicate findings clearly to stakeholders.
• Track and support remediation efforts and validate corrective actions.
• Analyze system-generated reports, configurations, logs, tickets, and other evidence to support testing conclusions.
• Coordinate with internal audit, global resources, compliance, cybersecurity, and business teams as needed.
• Support risk assessments, scoping, and annual planning activities for IT testing programs.
• Contribute to continuous improvement of testing approaches, templates, quality standards, and response testing frameworks.

A successful candidate would possess these skills:

• Ability to work independently and collaborate as part of a team
• Effective written and verbal communication skills
• Meticulous attention to detail and quality of work product
• Ability to build and sustain professional relationships
• Ability to lead projects or workstreams
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment
• Strong interpersonal skills and professional demeanor
• Ability to meet deadlines
• Ability to provide clear guidance to others

The team
Our team culture is collaborative and encourages team members to take initiative and seek on-the-job learning opportunities. Audit & Assurance services are focused on engagements related to independent External Audit services, Accounting, Controls & Reporting Advisory, and Specialized Assurance & Sustainability. We bring together the diverse skills and industry experience of our people, leading-edge technology, and a global network to deliver high-quality audits of financial statements and internal controls over financial reporting, along with assurance reports and valuable advice and insights across the corporate reporting landscape. Learn more about Deloitte Audit.

Qualifications

Required:

• Bachelor’s degree in Information Systems, Computer Science, Accounting, Cybersecurity, Risk Management, or related field.
• 2+ years of experience in ITGC testing, IT audit, risk advisory, internal controls, SOX compliance, or related areas.
• Experience with ISQM 1 and knowledge of QC1000.
• Understanding of IT control frameworks and concepts, including risks associated with access, change, and operations controls.
• Experience testing controls in Cloud, ERP, financial, operational, and cloud-based environments.
• Ability to assess evidence, exercise professional judgment, and document conclusions clearly.
• You should reside within a commutable distance of your assigned office with the ability to commute daily, if required
• You should expect to co-locate with team members or other colleagues in a Deloitte office, at a client site and/or virtually, based on specific team and business expectations
• Ability to travel up to 25%, on average, based on the type of work you perform and the clients served
• Limited immigration sponsorship may be available

Preferred:

• Master’s degree in Information Systems, Computer Science, Accounting, A
• Ability to pursue relevant certifications such as CISA, CISSP, CPA, CIA, or CRISC.
• Experience with Cloud & ERP platforms such as Azure, AWS, GCP, SAP, etc or similar enterprise systems.
• Experience with cloud environments, automated controls, and IT-dependent manual controls.
• Familiarity with regulatory and compliance environments such as ISQM, QC1000, SOX, internal audit, or external audit support.
• Experience leading teams, mentoring junior professionals, and reviewing work deliverables.

The wage range for this role takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; and other business and organizational needs. The disclosed range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Deloitte, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range is $72,500 to $120,870.

You may also be eligible to participate in a discretionary annual incentive program, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.