Sr. Data Engineer, Internal Audit (On-site/hybrid )

We’ve learned that what is best for patients is also best for employees. Learn more about why we are one of the Best Companies to Work for in Texas®.

The Senior Data Engineer is Internal Audit's technical specialist for enterprise data, information technology, and cybersecurity risk. This position independently builds and maintains reliable data pipelines. It also manages outsourced, risk-based IT audits from planning through reporting, serving as the primary liaison with the third-party audit firm. The role connects system activity to business processes, develops testable risk hypotheses, identifies exposures that may fall outside the third-party audit scope, and converts complex technical evidence into clear audit conclusions and practical recommendations. The position requires discretion with confidential and sensitive information and works closely with the Internal Audit team, explaining technical work and supporting detail to team members and stakeholders as needed.

Position Responsibilities
Data Engineering
• Design, build, document, monitor, and maintain secure ELT pipelines that acquire data from enterprise applications, databases, APIs, files, and approved cloud sources.
• Validate completeness and accuracy; clean, normalize, reconcile, join, and transform data; and load trusted data into approved warehouses, marts, or audit workspaces.
• Design and optimize databases, schemas, data models, and reusable analytical structures using advanced SQL. Use JavaScript or other tools when appropriate for integration and automation.
• Develop risk-based hypotheses with auditors and process owners, determine the data needed to test them, identify patterns or exceptions, investigate why they occurred, and distinguish indicators from confirmed findings.
• Produce reproducible, audit-ready workpapers that document sources, populations, transformations, parameters, validation, exceptions, limitations, code, and conclusions.
• Communicate results to audit team members for testwork and explain technical findings to management in clear business terms when needed.
IT Audit and Cybersecurity
• Serve as the department’s primary IT point of contact on outsourced IT audits.
• Understand system architecture, configurations, integrations, logs, security tooling, and technical terminology well enough to challenge explanations, identify missing risks, and recognize when audit evidence does not support management’s conclusion.
• Evaluate prior IT Audit finding management action plans and compensating controls to determine whether they address the risk and root cause, operate at the required precision and frequency, cover the full population, create reliable evidence, and reduce exposure to an acceptable level.
• Review external audit or assessment scopes and results to identify technology risks, systems, interfaces, dependencies, or control areas that were not addressed; coordinate evidence and follow-up without duplicating work unnecessarily.
• Communicate technical/system issues into business terms auditors and stakeholders can act on and communicate business risk back into technical terms IT can act on.

Education and Experience
Minimum
• Bachelor’s degree in computer science, information systems, data engineering, cybersecurity, accounting information systems, or
related fields. Four additional years of directly related experience may be substituted for the degree.
• 3-5 years of progressively responsible, hands-on data engineering experience, including production of ELT or ETL pipelines, data warehousing, database design or modeling, and data-quality controls.
• At least 2 years of experience supporting IT audit, IT risk management, information security, or IT controls work. This experience may be gained concurrently with the data engineering experience above.
Preferred
• Master’s degree in a related field.
• 7 or more years of hands-on data engineering experience.
• 3 or more years of IT audit or IT risk and controls experience.
• Healthcare or similarly regulated industry experience, including sensitive data and critical operational systems.
• Experience with EHR, ERP, HR and payroll, timekeeping, identity, security, audit management, backup, cloud, API, or OData platforms.

Licensures, Certifications, and Registrations
Minimum
• Active CISA or CISSP certification required within 18 months of hire and maintained in good standing thereafter. Continuing professional education (CPE) requirements for the applicable certification must be maintained throughout employment.
Preferred
• Active CISA certification at hire (CISSP also accepted). CISA is strongly preferred for audit responsibilities.
Skills and Abilities
Minimum
• Advanced SQL proficiency and hands-on experience with Microsoft SQL Server.
• Working proficiency in data transformation, analysis, and automation.
• Working knowledge of IT risk and controls frameworks such as NIST, COBIT, or ISO 27001.
• Ability to operate independently, learn unfamiliar systems, question incomplete explanations, manage competing priorities, and communicate effectively with engineers, process owners, executives, external auditors, and governance committees.
• Ability to collaborate effectively and build strong working relationships across audit, IT, and business teams.
Preferred
• Familiarity with MySQL or another major relational database platform.
• Experience using JavaScript, APIs, or OData for data integration and automation.
• Familiarity with FedRAMP requirements for cloud service providers.
• Familiarity with Workday and EPIC

UMC Health System provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment on the basis of race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

*Request for accommodations in the hire process should be directed to UMC Human Resources.​*