Audit, Technology

The opportunity:

Column runs on infrastructure we built ourselves, with no legacy banking core underneath it — which means when something needs auditing, there's no vendor to point to and no black box to wave at examiners. We're looking for a high-agency audit professional to own that problem, with a focus on Information Technology and Security alongside core banking, BSA/AML, and fintech-specific risk.

You'll run the full audit lifecycle — risk assessment, planning, fieldwork, reporting, follow-up — working directly with Information Security, Engineering, Payments, BSA/AML, Compliance, Lending, Growth, and TPRM. This isn't a background function checking boxes after the fact: you'll be embedded with these teams as they build, and what you find will shape how Column governs itself while scaling a nationally chartered bank.

This role is based in our Presidio office in San Francisco and follows a 3-4-day/week, in-person schedule. You will report to Column's Head of Internal Audit.

What you'll do:

• Design, lead, and execute end-to-end audits — scoping, fieldwork, reporting, issue follow-up — across core banking, technology, compliance, fintech partnerships, lending, payments, cards, and API infrastructure. Report findings straight to senior leadership.

• Own a risk-based audit plan built for what Column actually is: a software company running a regulated bank. Evolve it as we grow.

• Partner directly with Engineering and Information Security to audit SDLC, data protection, IAM, cybersecurity, cloud infrastructure, AWS, and how AI is used in our development process.

• Audit third-party risk management and fintech partner oversight against regulatory expectations.

• Use data analytics and AI to surface emerging risks, automate testing, and make audit faster and more efficient.

• Evaluate risk and control effectiveness across IT/IS, BSA/AML, sanctions, fair lending, consumer protection, privacy, and ALM/interest rate risk — grounded in NIST and regulatory expectations from the OCC, FRB, and FDIC.

• Manage third-party audit staff to keep delivery sharp and on time.

• Partner with the Head of Internal Audit level up the function itself: Audit Committee materials, QA, risk assessment, metrics.

   

What you'll need to be successful:

• 5-10 years of audit, risk, or compliance experience in banking, fintech, consulting, or technology

• Real technology audit depth — IT risk, cybersecurity, modern software development, including how AI is changing the dev process

• Hands-on audit ability in a cloud-native environment: AWS IAM, CI/CD, infrastructure as code (Terraform), secrets management

• Comfortable pulling and interpreting data straight from CloudTrail, Datadog, and Okta — via API or query, not just a dashboard

• Working knowledge of BSA/AML, sanctions (KYC, CDD, SAR, OFAC), and core banking regulation (OCC, FRB)

• You build trust fast — with engineers, senior leadership, and regulators

• CISA, CISSP, CIA, CISM, or CRISC certifications a plus

   

What you'll get from us:

• 🏥 Comprehensive health, dental, and vision plans, including options that are 100% covered by Column for you and 100% covered for your dependents!

• 📈 401k plan, including self-directed brokerage options

   

The annual US base salary range for this role is $150,000 - $200,000 + equity.