About This Role
An IT Auditor plans, designs, and executes various audits, including policy risk-based, process, and technical audits of systems, applications, and infrastructure. This role involves managing stakeholder engagements throughout the audit lifecycle and evaluating audit observations to assess ICT governance, risk management, and control practices.
Responsibilities
- Plan, design, and execute policy risk-based audits, process audits, and technical audits of systems, applications, and supporting infrastructure
- Manage stakeholder engagements with agencies throughout the audit lifecycle, including audit planning, briefings, fieldwork, management discussions, response reviews, and follow-up activities, to ensure timely and effective delivery of audit plans
- Review and evaluate audit observations to assess the overall state of ICT governance, risk management, and control practices across agencies and the Whole-of-Government environment
- Develop practical and risk-based recommendations and mitigation measures to strengthen ICT governance, security, and control effectiveness
- Collaborate with stakeholders at both operational and management levels to assess issues, identify root causes, and formulate recommendations to address identified gaps
- Monitor and validate the implementation of corrective actions to ensure audit findings have been effectively remediated and underlying root causes adequately addressed
- Conduct ICT&SS audits of Government agencies as assigned by Gov Tech’s Internal Audit Division (IAD)
- Perform in-depth reviews of Government agencies’ ICT&SS processes, applications, systems, and supporting infrastructure
- Facilitate the reporting and maintenance of audit findings in the designated central audit repository
Requirements
- At least 6 years of relevant experience in IT audit, with a proven track record of delivering audit engagements
- Proven experience leading end-to-end IT audit engagements, including planning, fieldwork, reporting and follow-up
- Strong understanding of cybersecurity principles, risk assessment, regulatory requirements, threats, vulnerabilities and security governance
- Experience assessing IT governance, controls and processes against recognised frameworks and standards such as COBIT, ITIL, NIST and ISO/IEC 27001
- Strong communication, stakeholder management, influencing and project planning skills
Nice to have:
- Familiarity with IM8 and/or equivalent ICT governance and security policies
- Experience in cloud computing (AWS, Azure, GCC), SaaS environments, application security or application development
- Possession of professional certifications such as CISA, CISSP, CISM, CRISC or equivalent
Benefits
