Senior IT Internal Auditor

Role Overview

IT Audit and Governance

• Conduct risk-based IT audits covering ITGCs, application controls, IT operations, ERP or Zoho systems, backup, disaster recovery, and business continuity.
• Develop and maintain IT policies, standards, procedures, and governance documentation aligned with ISO 27001:2022, DESC ISR, and BCM.
• Maintain the IT risk register, including assessments, treatment plans, residual risks, and remediation tracking.
• Support risk assessments for new systems, projects, and third-party engagements.

Audit and Compliance

• Coordinate ISO 27001, DESC ISR, internal, and external audits, including evidence collection, auditor liaison, findings, and corrective actions.
• Coordinate VAPT activities, remediation, and retesting.
• Maintain compliance evidence repositories, audit documentation, dashboards, and management reports.
• Support maintenance and testing of Business Continuity Plans and Disaster Recovery Plans.
• Assist with information security awareness initiatives and compliance training.
• Prepare management- and board-ready audit, risk, and compliance reports.

Third-Party Risk

• Support vendor and third-party risk assessments, including reviews of SOC reports, certifications, SLAs, and security documentation.

Qualifications and Experience

• Bachelor's degree in IT, Computer Science, Cybersecurity, Information Security, or a related field.
• Have 4–7 years of experience in IT audit, IT governance, risk, and compliance.
• Have practical knowledge of ISO/IEC 27001:2022 and DESC ISR.
• Have experience with ITGCs, IT risk management, VAPT, third-party risk, business continuity, and audit management.
• Have strong experience developing and reviewing IT policies, SOPs, controls, and process documentation.
• Have analytical, documentation, report-writing, and stakeholder management skills.
• Be proficient in Microsoft 365, including Excel, Word, and SharePoint.

Preferred Certifications

• CISA, CIA, ISO 27001 Lead Auditor or Lead Implementer, CRISC, or COBIT Foundation certification is preferred.