{"id":4256889,"url":"https://alion.io/job/ugicorp-it-audit-manager","title":"IT Audit Manager","company":{"id":3071778,"name":"UGI Corporation","domain":"ugicorp.com","url":"https://alion.io/company/ugicorp","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["King of Prussia, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AI Agents","optional":false},{"name":"Alteryx","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Hallucination","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"NIST CSF","optional":false},{"name":"Power BI","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"SQL","optional":false},{"name":"Tableau","optional":false},{"name":"Waterfall","optional":false},{"name":"Active Directory","optional":true},{"name":"CI/CD","optional":true},{"name":"Git","optional":true},{"name":"Linux","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Oracle ERP","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-10-21T00:00:00Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-11-13T14:16:12Z","board_verified":true,"closed_at":null,"days_open":23,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":23},"description":"Requisition Number: 30926\nThis position is based onsite at our King of Prussia, PA office and is not a remote role. Please apply only if you are able to work onsite at this location.\nUGI Corporation (NYSE: UGI) is a holding company that distributes and markets energy products and services through our subsidiaries and the company’s common stock is a balanced growth and income investment. UGI Corporation has paid common dividends for more than 135 consecutive years.\nIn addition to a challenging career and competitive compensation, our employees enjoy:\nGenerous and Family-friendly Health & Welfare Benefits Including:\nMedical, Vision, and Dental Plans\nOptional Health Savings Account\nOptional Dependent Care Savings Account\nPaid Maternity/Paternity Leave\nWork from home policy\nEmployee Assistance Program\nAdditional Benefits Include:\n401K with a generous company match\nTuition Reimbursement\nAssistance with Professional Credentialing\nReferral Bonuses\nEmployee Discount Programs\nPosition Summary:\nInternal Audit is an independent function that provides the Audit Committee and management with objective assurance, advice and insight on UGI’s risks, controls and governance, in conformance with The IIA’s Global Internal Audit Standards. The IT Audit Manager leads Internal Audit’s SOX IT controls testing and review, including the department’s use of AI and agentic AI tools to execute and document control testing. The role also leads assurance over major system implementations and enhancements, and risk-based IT, cybersecurity and operational technology (OT/ICS) audits across the UGI enterprise.\nThe role coordinates SOX testing with other IT and Business Process audit managers, the SOX management team (ICC) and the external auditor, and works closely with IT and OT leadership, the CISO and co-sourcing partners.\nEssential Functions:\n1. SOX IT Controls Testing and Review (35%)\nLead and review Internal Audit’s testing of IT general controls and automated application controls within the SOX scope defined by ICC. Serve as the primary reviewer of testing performed by IT senior auditors and co-source resources, ensuring the work meets IIA Standards, SEC requirements, and supports external auditor reliance.\nPlan and schedule SOX IT testing based on the scope and risk and control matrices provided by ICC; coordinate timing and integrated testing with other IT and Business Process audit managers.\nReview test plans and work papers for ITGCs (logical access, change management, IT operations, program development), automated application controls, key reports/IPE and interfaces, including sampling, evidence sufficiency and conclusions.\nDirect the use of AI and agentic AI tools in SOX testing and review AI-generated results with the same rigor as manually performed work.\nTest management’s controls over service organizations, including review of SOC 1/SOC 2 reports, bridge letters and complementary user entity controls.\nValidate test exceptions with control owners, communicate results to ICC, and support ICC’s deficiency evaluation.\n2. System Implementation and Enhancement Assurance (20%)\nProvide independent assurance over major system implementations, upgrades and enhancements (e.g., ERP, billing/customer, work and asset management, cloud migrations) from design through stabilization. Ensure financial, compliance and security controls are built into new systems before go-live rather than remediated afterward.\nPerform pre-implementation, in-flight (agile and waterfall) and post-implementation reviews of project governance, requirements, security and role design, segregation of duties, testing, cutover and hyper-care.\nAssess data migration completeness and accuracy, interface controls, and the impact of changes to SOX in-scope systems, coordinating with ICC on scope implications.\nAdvise project teams on control design while preserving Internal Audit’s independence and objectivity.\n3. IT, Cybersecurity and OT/ICS Audits (15%)\nPlan and lead risk-based audits of infrastructure, cybersecurity, cloud, data and operational technology environments across UGI’s utility, midstream and energy distribution businesses. Bring an informed point of view on emerging technology risk to management and the Audit Committee.\nAudit cybersecurity program areas, including identity and privileged access, vulnerability management, logging and monitoring, incident response, and resilience/recovery.\nAudit OT/ICS environments (e.g., SCADA, gas control, DCS/PLCs, historians, remote access), including IT/OT segmentation and asset inventory.\nTeam Leadership and Coordination (15%)\nLead, coach and develop IT senior auditors, staff and co-sourced resources, setting clear expectations, reviewing work papers and providing timely performance feedback. Serve as an Internal Audit liaison to IT and OT leadership and the CISO on audit scope, timing and results.\nManage co-source provider work quality, budget and knowledge transfer.\nUpskill the IT audit team on ITGC testing, data analytics and AI-enabled testing techniques.\nIssue clear, risk-rated audit reports that explain technical issues in business terms; validate root cause and agree practical, cost-effective remediation with management.\n5.AI-Enabled Testing, Data Analytics and IT Risk Assessment (15%)\nLead the design, validation and governance of the AI and agentic AI tools Internal Audit uses to perform control testing, together with data analytics and automation. Contribute IT, cyber and OT risk assessment and coverage to the annual audit plan and fulfill departmental administrative responsibilities.\nDesign and validate AI-enabled and agentic test procedures before use, including defined tasks, inputs and expected outputs, and accuracy and completeness checks against manually performed results.\nEnsure AI-assisted testing is reviewable and reproducible: retained evidence, documented prompts, configurations and tool versions, logs of agent actions, and documented review and sign-off by the accountable auditor.\nManage the risks of audit AI tools, including data confidentiality, access permissions for audit agents, and errors or hallucinations, in line with IIA Standards, UGI AI policy and external auditor expectations for reliance.\nMaintain the IT portion of the audit universe; manage engagement budgets and documentation in the audit management system and contribute to the Quality Assurance and Improvement Program (QAIP).\nKnowledge, Skills and Abilities:\nStandards and frameworks: Expert, practical application of The IIA’s Global Internal Audit Standards (including Topical Requirements), COSO Internal Control - Integrated Framework (2013), and working command of COBIT 2019, NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001:2022 and CIS Controls.\nSOX IT controls testing: Deep expertise in testing ITGCs, automated application controls, IPE/key reports, interface controls and segregation of duties/sensitive access; sound judgment on sampling, evidence sufficiency and work-paper review; understanding of how management scopes SOX and evaluates deficiencies, and of external auditor reliance requirements (PCAOB AS 2201 and AS 2605).\nTechnology stack: Hands-on ability to read and evaluate configurations, security parameters and role/access designs across Windows and Linux, Active Directory/Entra ID, Oracle and SQL Server databases, ERP and financial applications (e.g., SAP, Oracle, JD Edwards) and AWS/Azure cloud; to evaluate change management in Git-based, CI/CD and SaaS release environments; and to interpret vulnerability scanning, SIEM and identity governance outputs. Working knowledge of job scheduling, backup and recovery, and network security architecture.\nAI and agentic AI in audit: Hands-on ability to design, configure and validate AI- and agent-assisted test procedures (e.g., evidence extraction, attribute testing) and evidence their accuracy, completeness and audit trail; working knowledge of how generative and agentic AI tools operate (LLMs, retrieval-augmented generation, tool/API use, agent orchestration) and of their limitations (hallucination, incomplete extraction, inconsistency, data leakage); familiarity with The IIA’s AI Auditing Framework and the NIST AI RMF.\nOperational technology (OT/ICS): Ability to describe and assess an OT architecture (Purdue levels, IT/OT DMZ, remote access paths), common ICS components and protocols, and their principal cyber and operational risks, recognizing OT’s safety- and availability-first priorities; knowledge of relevant standards and regulation.\nProject and SDLC assurance: Knowledge of project governance, agile and waterfall delivery and ERP implementation lifecycles, and the controls that matter at each phase.\nData analytics and automation: Hands-on SQL and at least one analytics tool or language (e.g., Python, ACL, Alteryx, IDEA), with visualization (Power BI or Tableau), used to independently analyze system-generated data, test its completeness, accuracy, and perform testing and continuous monitoring.\nBusiness acumen and communication: Ability to translate complex technical issues into business risk, and to write and present concise, persuasive conclusions to senior management.\nLeadership and relationships: Proven ability to lead teams and co-source partners, manage multiple concurrent engagements on time and within budget, and build credible relationships with technical and non-technical stakeholders.\nTravel and work location: Ability to travel approximately 5% (domestic and international), including visits to operational sites to observe OT environments, and to commute to Reading locations on occasion.\nMinimum Qualifications: Please list required levels of education, professional certifications and specific experience.\nEducation:\nBachelor’s degree in Information Systems/MIS, Computer Science, Cybersecurity, Computer or Electrical Engineering, or Accounting with an Information Systems concentration.\nPreferred: Master’s degree (e.g., MSIS, Cybersecurity, Data Science or MBA).\nLength of Experience: Minimum 8 years of progressive IT audit, IT risk or technology assurance experience, including:\nAt least 5 years performing and reviewing SOX ITGC and application control testing for SEC registrants (Big 4 or national public accounting firm experience strongly preferred).\nAt least 3 years in a supervisory or manager capacity (scoping engagements, reviewing work papers, leading staff and/or co-source teams).\nLead or significant role on at least two assurance reviews of ERP or other major financial system implementations or upgrades (pre- and post-implementation).\nCertifications: Required:\nActive CISA (Certified Information Systems Auditor, ISACA).\nPlus at least one additional active credential: CPA, CIA, CISSP, CISM, CRISC, CCSP or GICSP.\nPreferred:\nAI audit/governance: ISACA AAIA (Advanced in AI Audit) or IAPP AIGP.\nOT/ICS: GIAC GICSP or GRID, or ISA/IEC 62443 Cybersecurity certificate.\nCloud: AWS or Microsoft Azure security certification, or CSA CCSK/CCSP.\nProject: PMP or Agile (e.g., PMI-ACP, Certified ScrumMaster).\nAll credentials must be maintained in active status with required CPE.\nOther: Required:\nExperience performing risk-based audits of core IT functions (infrastructure, applications, databases, information security, cloud).\n\nAll offers of employment are contingent upon the successful completion of a background check and drug screen, subject to applicable laws and regulations.\nUGI Corporationis an Equal Opportunity Employer. The Company does not discriminate on the basis of race, color, sex, national origin, disability, age, gender identity, sexual orientation, veteran status, or any other legally protected class in its practices.","description_format":"text","description_chars":11674,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":3,"team_size_min":2,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["401k plan"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security"],"lifecycle":[{"event":"open","at":"2026-11-13T14:16:12Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.799,"p_room":0.75,"age_days":23,"expected_fill_days":30,"reasons":["conf:1","win:late","comp:brand"],"computed_at":"2026-11-13T16:00:53Z"},"pay":null,"html_url":"https://alion.io/job/ugicorp-it-audit-manager","json_url":"https://alion.io/job/ugicorp-it-audit-manager.json","meta":{"generated_at":"2026-11-13T16:00:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32083,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3071778},"rest":"https://alion.io/mcp/rest/get_company?id=3071778"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fugicorp-it-audit-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fugicorp-it-audit-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fugicorp-it-audit-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ugicorp-it-audit-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fugicorp-it-audit-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4256889}},{"tool":"search_jobs","arguments":{"company":"ugicorp.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4256889},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}