Cybersecurity & Technology Audit Leader

About the Team The OpenAI Audit Team is on a mission to build the future of internal audit from the ground up. Our ambition will be powered by a high-energy, technically exceptional team with the judgment, intellectual curiosity, and creativity to harness the latest advances in AI and design a truly next-generation audit function. As AI reshapes how work is performed across the enterprise, Internal Audit will use AI, automation, and data analytics to identify and assess the most significant and emerging risks across the business, including technology, cybersecurity, finance, compliance, operations, and data. We will build trusted partnerships at every level—from the Board of Directors and senior leadership to the teams delivering on OpenAI’s mission every day. We will operate as both an independent assurance provider and a trusted advisor, bringing an objective and pragmatic perspective to critical decisions. By engaging closely with management while preserving our independence, we will help the business innovate responsibly, move with confidence, and manage risk without creating unnecessary barriers. About the Role As the Cybersecurity & Technology Audit Leader, you will help shape the strategy, methodology, technology, and culture of a new audit function. You will lead complex audits and advisory reviews of cybersecurity, technology, data, and AI-related risks while advising leaders on practical ways to strengthen governance, resilience, and risk management. You are an experienced, hands-on professional who combines deep technical expertise with strong business judgment. You can quickly move between executive-level governance questions and detailed technical analysis, use data to identify and assess risk, and form clear, well-supported conclusions in fast-moving or ambiguous situations. You will have meaningful influence over how the function develops, including how we apply AI, automation, and analytics to audit planning, testing, monitoring, and reporting. This is an opportunity to help build a state-of-the-art capability rather than inherit a traditional audit model. This role is based in San Francisco, CA. We use a hybrid work model of 3 days in the office per week and offer relocation assistance to new employees. In this role, you will: - Build and execute a risk-based audit and advisory strategy across cybersecurity, infrastructure, systems architecture, cloud environments, data, software development, change management, operational resilience, and AI. - Drive strong governance and oversight of critical technology programs and emerging AI risks, including model governance, data provenance and quality, privacy, security, responsible AI, third-party dependencies, monitoring, and human oversight. - Assess complex technical environments and control effectiveness across areas—such as architecture, access models, system logs, code repositories, cloud controls, vulnerability data, and security monitoring—with a focus on distinguishing material risks from lower-value compliance issues. - Translate complex technical findings into clear business implications and practical recommendations that enable innovation while supporting effective risk management. - Build advanced audit capabilities using data analytics, automation, and AI to improve risk assessment, audit scoping, testing, continuous monitoring, and reporting, including identifying anomalies, control weaknesses, and emerging risks. - Build trusted relationships across the organization and support clear, effective reporting to executive management, regulators, and the Board. - Monitor developments in technology, threat activity, regulation, and industry practices to keep the audit approach current and forward-looking. - Coach colleagues, share technical expertise, and contribute to a culture of high standards, sound judgment, curiosity, ownership, and continuous learning. You might thrive in this role if you have: - 12-15+ years of relevant experience in cybersecurity, technology audit, technology risk, security engineering, data risk, cloud security, or a related field. - Strong technical expertise across several areas, such as cloud platforms, identity and access management, application security, infrastructure, networks, vulnerability management, incident response, security operations, data platforms, or software development. - Strong knowledge of data architecture, provenance, lineage, quality, governance, access, and analytics, including the risks associated with using data in AI systems. - Knowledge of AI and machine-learning risks, along with experience using data analytics, scripting, automation, or AI-assisted techniques—or a demonstrated ability to develop these capabilities quickly. - The ability to understand complex systems, ask incisive questions, evaluate incomplete information, and reach well-supported conclusions with sound judgment. - The confidence to challenge constructively and a busine