IT Internal Audit

Responsibilities

• Help maintain the IT audit universe, identify technology risks, and prepare the risk-based IT audit plan
• Plan and conduct assigned IT audits: audit programs, walkthroughs, control testing, documentation
• Review IT policies, governance, and risk management against QCB requirements and internal policies
• Assess IT general controls: user and privileged access, segregation of duties, change management, system development, production deployment
• Review application controls and data integrity: critical applications, payment systems, databases, interfaces, reconciliations
• Review infrastructure, cybersecurity, and IT operations: networks, servers, cloud, patching, security monitoring, incident management
• Escalate areas needing specialist assessment to the Chief Internal Auditor
• Assess disaster recovery and resilience: backups, restoration, recovery objectives, recovery testing, gap follow-up
• Review IT vendors and projects: service agreements, access security, testing, data migration, implementation readiness
• Use approved analytics tools to find exceptions; maintain secure digital working papers with sufficient evidence
• Discuss preliminary findings and draft reports with risks, root causes, recommendations, and action plans
• Track agreed actions, verify implementation, and report overdue items
• Provide IT risk and control advice and support the technology aspects of other audits
• Maintain objectivity and confidentiality without assuming management responsibilities

Requirements

• Bachelor's degree in computer science, IT, information systems, or a related field
• CISA certification (mandatory, must be kept in good standing); other certifications are an advantage
• Sound knowledge of risk-based IT auditing, audit methodology, IT controls, and ethics
• Ability to apply QCB requirements to audits; financial services experience is an advantage
• Strong analytical skills, attention to detail, and clear, concise, evidence-based reporting
• Integrity, objectivity, confidentiality, professional skepticism, and continuous learning
• 3–5 years of relevant experience, with at least 2 years of hands-on IT audit work
• Experience across the full audit lifecycle, managing day-to-day activities under supervision
• Experience assessing IT general and application controls, with exposure to cybersecurity, infrastructure, or DR reviews
• Banking, exchange house, payment provider, or fintech experience preferred but not mandatory.