About This Role
This role is for an IT Auditor who will plan and execute audits focusing on cybersecurity, IT general controls, application controls, and technology risks. The position involves assessing risks, evaluating controls, ensuring regulatory compliance, and collaborating with various teams to implement security measures.
Responsibilities
- Prepare risk-based audit plans aligned with audit objectives and regulatory expectations
- Construct audit-specific engagement letters based on defined audit scopes and timelines
- Conduct audits covering cybersecurity, IT general controls, application controls, and technology risks
- Identify security gaps and vulnerabilities in Assessment and Penetration Testing (VAPT) reports for critical applications, assess impact, and recommend mitigation measures
- Assess the design and operating effectiveness of controls through detailed review and analysis
- Perform analytical procedures to evaluate control effectiveness and risk exposure
- Ensure RBI Cybersecurity Guidelines, PCI DSS, and other applicable frameworks
- Perform and coordinate KRI submissions to RBI across various risk parameters
- Evaluate IT policies, risk management frameworks, and BCP/DRP for adequacy and compliance
- Conduct third-party and cloud security assessments, including review of cloud security configurations, encryption, and access controls
- Develop comprehensive documentation for audit procedures and ensure accuracy through cross-referencing of work papers
- Create preliminary and final audit reports for circulation to auditees and senior management
- Prepare clear, concise audit observations highlighting risks, root causes, and actionable recommendations
- Track closure and remediation of audit findings
- Facilitate discussions with management and process owners regarding audit observations and corrective actions
- Collaborate closely with IT, Information Security, and business teams to implement controls
- Facilitate knowledge sharing and mentoring among team members to enhance audit quality
- Conduct security awareness programs to strengthen employee understanding of cybersecurity risks and controls
Requirements
- Strong understanding of IT audits, cybersecurity, ITGCs, and application controls
- Hands-on experience with audit planning, walkthroughs, IDR management, and documentation
- Knowledge of regulatory and industry standards (ISO 27001, RBI, PCI DSS)
- Strong analytical, documentation, and communication skills
- Ability to manage multiple audits and stakeholder expectation
- Inter CA/Bachelor's degree in information technology, Computer Science, Cybersecurity, or related field
Nice to have:
- Certifications such as CISA, CISM, ISO 27001 LA/LI, CEH
