Scope of the Role
Being the Team Leader in IS Audit department, you are to oversee the planning and execution of IS, IT, operational, and compliance audits across the organization. Review and assess the effectiveness of internal IT controls, risk management processes, and governance frameworks. And ensure audits adhere to relevant regulations, industry standards, and internal policies.
Job Description
Key Responsibilities:
- Strategy & Planning:
- Develop and implement a comprehensive IS audit strategy aligned with the company's objectives.
- Create the annual IS audit plan, including audit scope, resources, and scheduling.
- Perform risk assessments to identify key areas of IT risk and control weaknesses.
- Audit Execution & Oversight:
- Oversee the planning and execution of IS, IT, operational, and compliance audits across the organization.
- Review and assess the effectiveness of internal IT controls, risk management processes, and governance frameworks.
- Ensure audits adhere to relevant regulations, industry standards, and internal policies.
- Team Leadership & Management:
- Lead, mentor, and develop a high-performing team of IS auditors.
- Manage the workload and assignments of the audit team.
- Foster a culture of professional growth, excellence, and ethical conduct within the audit department.
- Reporting & Communication:
- Prepare and present clear, concise audit reports detailing findings, risks, and actionable recommendations.
- Communicate significant risks and findings proactively.
- Coordinate with external auditors to ensure alignment and efficiency.
- Continuous Improvement & Compliance:
- Stay informed about emerging trends, new technologies, and regulatory changes in the field of information systems.
- Collaborate with other departments to implement corrective actions and improve IT processes.
- Monitor the implementation of audit recommendations to ensure they are effective.
Ideal Candidates
Looking for candidates with ample of experience in IS Audit or IT audit in a Bank or in any of the Big 4's.
Work Experience
- Relevant Experience: A minimum of 15 years of experience in information systems auditing, control, or security out of which at least 5 years in Information system security management and 3 to 5 years in a leadership role.
- Banking Sector Experience: Experience within the banking or financial services industry is a significant advantage, providing familiarity with core banking systems, financial products, and industry-specific risks. Shall be familiar with RBI circulars and policies, particularly those related to cyber security and IT infrastructure.
- Proven track record in managing regulatory audits, cybersecurity assessments, and risk-based audit
- Should have led or participated in at least 10 VAPT engagements for banks or financial institutions in the last 5–10 years.
Skills Required
- Technical: In-depth knowledge of network architecture, firewalls, intrusion detection systems, application security, database management, and cloud technologies. Familiarity with IT audit frameworks like COBIT and ITIL. Hands-on experience in conducting VAPT across Core banking systems, Mobile and internet banking platforms, Network infrastructure, Cloud environments and data centers. Proficiency in manual and automated vulnerability scanning tools / Penetration testing tools, secure coding practices and OWASP Top 10, Network analysis and sniffing tools, Password Cracking & Brute Force Tools, Web application testing tools, etc
- Analytical: Strong ability to analyze complex systems, identify vulnerabilities, assess risks, and interpret large datasets using data analytics tools.
- Communication: Excellent written and verbal communication skills to document findings clearly and explain complex technical issues to both technical teams and non-technical senior management
- Problem-Solving: Ability to investigate irregularities, identify root causes of issues, and recommend effective control measures
- Professionalism: Adherence to professional ethics, objectivity, and independence in attitude and appearance.
Educational Qualifications
- Bachelor's Degree: A minimum of a bachelor's degree in engineering (B Tech) in Computer Science or Information Technology
- Master's Degree (Preferred): A master's degree (MTech/MS) in Cybersecurity or Information Systems or any related field
Professional Certifications (CISA plus any 2 or more)
- Certified Information Systems Auditor (CISA)
- Certified Information Security Manager (CISM)
- Certified in Risk and Information Systems Control (CRISC)
- Certified Information Systems Security Professional (CISSP)
- ISO 27001:2022 Lead Auditor
- Certified Ethical Hacker (CEH v10)
- Cisco Certified Network Analyst (CCNA)