Principal, External Audit Engagement

Note: Fidelity will not provide immigration sponsorship for this position. The Role: Are you ready to take on a meaningful role at Fidelity Investments, ensuring our cybersecurity controls are second to none? The Fidelity Enterprise Cybersecurity Regulatory and Audit Team is seeking a Principal, External Audit Engagement to play a major role in our engagements with independent third-party audit firms. You will demonstrate adherence to leading industry frameworks, ensuring our control environment is flawless. Success in this role will be showcased through well-managed external audit engagements resulting in unqualified opinions and certifications of Fidelity’s cyber control environment. The Team: We, the Cyber Regulatory and Audit Team within Enterprise Cybersecurity’s Information Security Office, are dedicated to knowing the external requirements and standards to which Fidelity is held. We ensure that Fidelity ECS has the appropriate policies and controls aligned to these standards. Our team engages external assessors and examination staff to provide evidence of control, helping to maintain our relentless dedication to our clients. Fidelity’s Onsite Working Model: Fidelity is transitioning to a full-time onsite working model through a phased rollout across regions and roles. Currently, some roles and locations require 100% onsite presence, while others require less. Onsite expectations are likely to evolve as the rollout continues. This transition does not apply to fully remote roles.

Responsibilities

Play a major role in engagements with independent third-party audit firms; Demonstrate adherence to leading industry frameworks; Ensure Fidelity’s control environment is flawless; Achieve well-managed external audit engagements resulting in unqualified opinions and certifications of Fidelity’s cyber control environment

Requirements

Proven knowledge of IT risk and cybersecurity functions and their importance to Fidelity’s mission; Extensive knowledge of audited cybersecurity frameworks and standards, including AICPA’s SOC 1, SOC 2, and SOC 3, PCI-DSS, HITRUST, Swift CSP and ISO/IEC 27000 family; Experience managing projects end-to-end with a clear ability to communicate progress effectively; Understanding of NIST Cybersecurity Framework core standards; Minimum 5 years working in IT assurance for a Big 4 or similar audit firm, with experience serving Fortune 500 clients; Prior experience in a cybersecurity role, IT audit, or IT risk role

Nice to have

Bachelor’s degree in a technology or computer science subject area, or equivalent experience (preferred); Possession of cybersecurity certifications (plus)