It Audit Manager

Figma Figma · Enterprise · Canada +1 · Business Operations

Figma is seeking an IT Audit Manager to establish and lead their IT risk management function and operational audit capability. This role will support the IT SOX compliance program, develop risk-based operational audit plans, and identify and assess IT risks, including those related to emerging technologies like AI. The position requires strong IT audit and risk management experience, with a focus on SOX compliance and building programs from scratch.

What you'd actually do

  1. Execute the IT SOX compliance program: ITGC and ITAC testing, deficiency management, remediation tracking, and SOX documentation. Coordinate with external auditors and co-sourced resources throughout the audit cycle.
  2. Provide technical support in the assessment, design, and implementation of IT General Controls and IT Application Controls in collaboration with GRC and IT management. Participate in system upgrades and implementations to ensure controls over financial reporting are adequately identified and addressed.
  3. Lead IT risk conversations with management and contribute to the IT risk register. Support the buildout of Figma's IT risk management program, including risk identification methodology, assessment frameworks, and leadership reporting.
  4. Contribute to risk updates for the Audit Committee and senior leadership as it relates to the IT risk landscape, including emerging technology risks such as cloud, SaaS, and AI.
  5. Develop a risk-based operational audit plan and implement audits across IT and business process areas, including where no prior year workpapers exist. Issue findings with risk ratings and actionable recommendations; track remediation to closure.

Skills

Required

  • 6+ years in IT audit, IT risk management, or a combination thereof
  • IT SOX compliance experience with hands-on ownership of ITGCs, ITACs, and Segregation of Duties
  • Experience performing operational or integrated audits, including in environments without established playbooks
  • Knowledge of PCAOB/SEC requirements and audit frameworks, including CISA, CIA, or CISM certifications
  • Ability to collaborate across Internal Audit and cross-functional teams (GRC, IT, Finance, Legal, Business Systems)

Nice to have

  • Experience supporting the development of a risk management program
  • SaaS or fast-paced tech company experience
  • Familiarity with GRC tools (AuditBoard, Workiva, ServiceNow GRC, or similar)
  • Experience with data analytics tools (ACL, IDEA, or similar) for audit processes
  • Cloud security knowledge and audit experience

What the JD emphasized

  • IT SOX compliance program
  • ITGC
  • ITAC
  • risk management program
  • operational audit