Lead, IT Audit and Technology Risk
Notion · Location not specified · Remote
Notion
Notion has become one of the defining productivity platforms of the last decade, evolving from a niche notes-and-wiki tool founded in 2013 by Ivan Zhao and Simon Last into an all-in-one workspace blending docs, databases, project management, and now AI agents. It competes with a sprawling field that includes Confluence and Jira (Atlassian), Asana, Coda, Airtable, and increasingly Microsoft Loop and Google Workspace, having carved out differentiation through its flexible block-based architecture and strong grassroots adoption among startups, creators, and enterprises alike. The company has repositioned itself as an "AI workspace" where human and machine collaborators work side by side, reflecting a broader industry shift toward agentic software.
Gig description
WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together https://www. youtube. com/watch? v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT THE ROLE: We are seeking a strategic and technically fluent Lead, IT Audit to join our Finance team reporting to the Head of Internal Audit. This is a broad, high-impact role spanning both IT SOX compliance and operational IT audits. You will help establish and elevate our technology controls program end to end — owning the IT SOX lifecycle, designing the IT general and application controls framework, embedding AI and automation into how we test and monitor controls, and delivering value-added operational IT and cybersecurity audits that strengthen how the company builds and runs its systems. You will partner with leaders across Engineering, Security, IT, Finance, and the business to ensure sound technology controls are built into how the company operates as we scale. This role is ideal for someone who thinks like a builder, not just an auditor — someone who can translate complex control and security requirements into practical, scalable processes in a fast-moving SaaS environment with modern cloud architecture and complex data flows. This role can be based in either San Francisco or New York City. We work from our offices on Mondays, Tuesdays and Thursdays (our Anchor Days) because we do our best thinking and building together in person. We’re looking for someone who’s excited to work alongside the team during those days. WHAT YOU'LL ACHIEVE: - Own the full IT SOX lifecycle — scoping, risk assessment, documentation, walkthroughs, testing, deficiency evaluation, remediation, and reporting — driving automation and efficiency across IT general controls (ITGCs) and IT application controls (ITACs) - Design, operate, and continuously improve technology controls spanning user access and segregation of duties, change management, SDLC and CI/CD pipelines, interfaces, data flows, and system-generated reports - Design and execute value-added operational IT and cybersecurity audits — across cloud infrastructure, security operations, identity and access management, data protection and privacy, disaster recovery and resilience, and vendor and third-party risk — while driving enterprise-level technology risk assessment that anticipates emerging risks before they materialize - Serve as a strategic advisor on cross-functional initiatives (product launches, new systems, architecture changes, M&A) and as the primary point of contact for external auditors, ensuring sound controls are built in from day one and audit evidence is complete, clear, and timely - Own IT control deficiencies from identification through sustained remediation while partnering with and educating system owners to build a culture of ownership and accountability - Champion the adoption of AI and modern tooling — from automated control testing and anomaly detection to continuous monitoring and AI-assisted documentation — to make the IT audit function smarter, faster, and more forward-looking SKILLS YOU'LL NEED TO BRING: - 12+ years of progressive IT audit, IT SOX, or technology risk experience, with a combination of Big 4 and high-growth technology company experience - Deep, hands-on ownership of IT SOX/ITGC programs, with a strong understanding of PCAOB standards, SEC requirements, and frameworks such as COSO, COBIT, NIST, and ITIL - Demonstrated experience designing and leading operational IT audits end to end — including annual planning, risk-based scoping, fieldwork, and reporting — across areas such as IT operations, infrastructure resilience, disaster recovery and business continuity, capacity and availability management, and IT vendor and third-party risk - Strong cybersecurity audit experience with working fluency in frameworks and regulations such as NIST CSF, ISO 27001, SOC 2, GDPR, and CCPA, and the ability to translate them into practical, testable controls - Software or SaaS industry experience is a must — particularly modern cloud-based technology stacks (AWS, GCP, Azure), software development lifecycles, and complex data flows — paired with strong technical knowledge across cloud security configurations, identity and access management, change management, DevOps and CI/CD pipelines, and enterprise IT operations risks and controls - Process leadership — a track record of building functions, designing new processes and policies, and driving continuous improvement - Bachelor's degree in Information Systems, Computer Science, Accounting, or a related field; CISA, CISSP, CISM, CIA, CPA, or equivalent certification required - Strong stakeholder management and communication skills, with the ability to translate complex technical and audit topics into clear language and influence partners across all levels of the organization Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role’s scope and complexity, and the candidate’s experience and expertise, and may vary from the range provided below. For roles based in San Francisco, the estimated base salary range for this role is $185,000 - $220,000 per year. By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion. notion. site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550. https://dev. notion. so/a3ce416456924276a59de91bca740028? pvs=21 #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.
Requirements to meet
Disclaimer
Suggestions only — review each course yourself to judge whether it meets the role's requirements. Completing a course doesn't guarantee proficiency or that you'll qualify; hiring standards vary by employer.
Certifications required
Certified Information Systems Security Professional (required)
ISC2Skills required
AWS (required)
GapCourses that may help you meet this requirement:
AWS Fundamentals Specialization
Coursera · beginner · $49/mo · 40h · ★ 4.8
This course covers AWS, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 40 hours.
AWS Cloud Technical Essentials
Coursera · beginner · $49/mo · 20h · ★ 4.8
This course covers AWS, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 20 hours.
AWS Cloud Solutions Architect Professional Certificate
Coursera · intermediate · $49/mo · 62h · ★ 4.8
This course covers AWS, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at an intermediate level and can be completed in approximately 62 hours.
GCP (required)
GapCourses that may help you meet this requirement:
Google Cloud Fundamentals: Core Infrastructure
Coursera · beginner · Price on site · 6h · ★ 4.7
This course covers GCP, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 6 hours.
Building Scalable Java Microservices with Spring Boot and Spring Cloud
Coursera · intermediate · $49/mo · 1h · ★ 4.3
This course covers GCP, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at an intermediate level and can be completed in approximately 1 hours.
Machine Learning Operations (MLOps) on Google Cloud Specialization
Coursera · intermediate · $49/mo · 16h · ★ 4.0
This course covers GCP, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at an intermediate level and can be completed in approximately 16 hours.
Azure (required)
GapCourses that may help you meet this requirement:
Describe security and compliance concepts
Microsoft Learn · beginner · Free · 48m · ★ 4.8
This course covers Azure, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 1 hours.
Embrace responsible AI principles and practices
Microsoft Learn · beginner · Free · 58m · ★ 4.8
This course covers Azure, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 1 hours.
Improve your reliability with modern operations practices: Incident response
Microsoft Learn · beginner · Free · 33m · ★ 4.7
This beginner course is recommended to help build foundational Azure knowledge needed for the Lead, IT Audit and Technology Risk role, though it does not explicitly cover Azure-specific content based on available keyword matches.
Change Management (required)
GapCourses that may help you meet this requirement:
Program Strategy, Governance and AI-Enabled Decision Making Specialization
Coursera · beginner · $49/mo · 34h · ★ 4.7
This course directly covers Change Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 34 hours.
Stakeholder Management
Coursera · beginner · $49 · 5h · ★ 4.6
This course directly covers Change Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 5 hours.
Get started with Engineering Change Management for Dynamics 365 Supply Chain Management
Microsoft Learn · intermediate · Free · 2h · ★ 4.8
This course directly covers Change Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at an intermediate level and can be completed in approximately 2 hours.
CI/CD (required)
GapCourses that may help you meet this requirement:
Introduction to Git
Microsoft Learn · beginner · Free · 1.5h · ★ 4.8
This course is recommended to address the CI/CD skill gap for the Lead, IT Audit and Technology Risk role, though no specific matched keywords were provided to substantiate direct coverage of CI/CD topics.
Manage software delivery by using a release based workflow on GitHub
Microsoft Learn · beginner · Free · 1.5h · ★ 4.8
This course covers CI/CD, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 2 hours.
Define the foundation pillars of DevOps: Architecture and Technology
Microsoft Learn · beginner · Free · 16m · ★ 4.8
This beginner course on DevOps architecture and technology foundations helps address the CI/CD skill gap for the Lead, IT Audit and Technology Risk role by introducing foundational DevOps concepts relevant to CI/CD practices.
Security (required)
GapCourses that may help you meet this requirement:
Describe security and compliance concepts
Microsoft Learn · beginner · Free · 48m · ★ 4.8
This course directly covers Security, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 1 hours.
Describe monitoring tools in Azure
Microsoft Learn · beginner · Free · 13m · ★ 4.8
This beginner course on Azure monitoring tools is recommended to help address the Security skill gap for the Lead, IT Audit and Technology Risk role, though no specific matched keywords were identified linking the course content directly to this skill.
Secure your Azure resources with Azure role-based access control (Azure RBAC)
Microsoft Learn · beginner · Free · 37m · ★ 4.7
This course covers Security, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 1 hours.
Privacy (required)
GapCourses that may help you meet this requirement:
Explore core data concepts
Microsoft Learn · beginner · Free · 35m · ★ 4.8
This course covers Privacy, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 1 hours.
Describe the embedded experiences of Microsoft Security Copilot
Microsoft Learn · beginner · Free · 52m
This course covers Privacy, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 1 hours.
Investigate threats using audit in Microsoft Defender XDR and Microsoft Purview (Premium)
Microsoft Learn · intermediate · Free · 46m · ★ 4.8
This course covers Privacy, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at an intermediate level and can be completed in approximately 1 hours.
Risk Management (required)
GapCourses that may help you meet this requirement:
Introduction to Risk Management
Coursera · beginner · $79/mo · 17h · ★ 4.7
This course directly covers Risk Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 17 hours.
Operational Risk Management: Frameworks & Strategies
Coursera · beginner · $79/mo · 6h · ★ 4.6
This course directly covers Risk Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 6 hours.
Privacy Law and Data Protection
Coursera · $79/mo · 13h · ★ 4.8
This course covers Risk Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting and can be completed in approximately 13 hours.
Stakeholder Management (required)
GapCourses that may help you meet this requirement:
Introduction to Project Management
Coursera · beginner · $49/mo · 10h · ★ 4.8
This course directly covers Stakeholder Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 10 hours.
Business Analysis & Process Management
Coursera · beginner · Price on site · 2h · ★ 4.5
This course directly covers Stakeholder Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 2 hours.
Project Management Communication, Stakeholders & Leadership
Coursera · intermediate · $49/mo · 20h · ★ 4.6
This course directly covers Stakeholder Management, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at an intermediate level and can be completed in approximately 20 hours.
Accounting (required)
GapCourses that may help you meet this requirement:
Financial Accounting: Foundations
Coursera · beginner · $79/mo · 10h · ★ 4.7
This course directly covers Accounting, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 10 hours.
Accounting: Principles of Financial Accounting
Coursera · beginner · $79/mo · 14h · ★ 4.8
This course directly covers Accounting, which appears as a requirement in the Lead, IT Audit and Technology Risk posting at a beginner level and can be completed in approximately 14 hours.
Get started with cost accounting in Dynamics 365 Finance
Microsoft Learn · beginner · Free · 1.5h · ★ 4.6
This beginner course covers accounting fundamentals, directly addressing the Accounting skill gap identified for the Lead, IT Audit and Technology Risk role.