Sr. Data Engineer, Internal Audit

UMC Health System is hiring a Senior Data Engineer to support Internal Audit with enterprise-grade data and IT/cybersecurity risk expertise. This hybrid role in Lubbock, TX focuses on building reliable, secure data pipelines and turning technical evidence into audit-ready conclusions that teams can act on.

Responsibilities

• Independently build and maintain reliable data pipelines.
• Manage outsourced, risk-based IT audits from planning through reporting, serving as the primary liaison with the third-party audit firm.
• Connect system activity to business processes by developing testable risk hypotheses, identifying potential exposures outside third-party audit scope, and translating complex technical evidence into clear audit conclusions and practical recommendations.
• Design, build, document, monitor, and maintain secure ELT pipelines to acquire data from enterprise applications, databases, APIs, files, and approved cloud sources.
• Validate completeness and accuracy; clean, normalize, reconcile, join, and transform data; and load trusted datasets into approved warehouses, marts, or audit workspaces.
• Design and optimize databases, schemas, data models, and reusable analytical structures using advanced SQL.
• Use JavaScript or other tools as appropriate for integration and automation.
• Develop risk-based hypotheses with auditors and process owners, define the data needed for testing, identify patterns or exceptions, investigate root causes, and distinguish indicators from confirmed findings.
• Produce reproducible, audit-ready workpapers documenting sources, populations, transformations, parameters, validation results, exceptions, limitations, code, and conclusions.
• Communicate results to audit team members for testwork, and explain technical findings to management in clear business terms when needed.
• Serve as the department’s primary IT point of contact on outsourced IT audits.
• Understand system architecture, configurations, integrations, logs, security tooling, and technical terminology well enough to challenge explanations, identify missing risks, and recognize when audit evidence does not support management’s conclusion.
• Evaluate prior IT Audit finding management action plans and compensating controls to confirm they address risk and root cause, operate at required precision and frequency, cover the full population, produce reliable evidence, and reduce exposure to an acceptable level.
• Review external audit or assessment scopes and results to identify technology risks, systems, interfaces, dependencies, or control areas not addressed; coordinate evidence and follow-up while avoiding unnecessary duplication.
• Translate technical/system issues into business terms for auditors and stakeholders, and communicate business risk back into actionable technical terms for IT.
• Work closely with the Internal Audit team by explaining technical work and supporting detail for team members and stakeholders as needed.

Requirements

• Bachelor’s degree in computer science, information systems, data engineering, cybersecurity, accounting information systems, or related fields; four additional years of directly related experience may be substituted.
• 3-5 years of progressively responsible, hands-on data engineering experience, including production of ELT or ETL pipelines, data warehousing, database design or modeling, and data-quality controls.
• At least 2 years supporting IT audit, IT risk management, information security, or IT controls work (may be concurrent with the data engineering experience).
• Active CISA or CISSP certification required within 18 months of hire and maintained in good standing thereafter, with applicable CPE requirements maintained throughout employment.
• Advanced SQL proficiency with hands-on experience in Microsoft SQL Server.
• Working proficiency in data transformation, analysis, and automation.
• Working knowledge of IT risk and controls frameworks such as NIST, COBIT, or ISO 27001.
• Ability to operate independently, learn unfamiliar systems, question incomplete explanations, manage competing priorities, and communicate effectively with engineers, process owners, executives, external auditors, and governance committees.
• Ability to collaborate effectively and build strong working relationships across audit, IT, and business teams.

Preferred (Not Required)

• Master’s degree in a related field.
• 7+ years of hands-on data engineering experience.
• 3+ years of IT audit or IT risk and controls experience.
• Healthcare or similarly regulated industry experience, including sensitive data and critical operational systems.
• Experience with EHR, ERP, HR and payroll, timekeeping, identity, security, audit management, backup, cloud, API, or OData platforms.
• Active CISA at hire (CISSP also accepted), with CISA strongly preferred.
• Familiarity with MySQL or another major relational database platform.
• Experience using JavaScript, APIs, or OData for data integration and automation.
• Familiarity with FedRAMP requirements for cloud service providers.
• Familiarity with Workday and EPIC.

Technologies: ELT, ETL, SQL, Microsoft SQL Server, JavaScript, NIST, COBIT, ISO 27001, CISA, CISSP.