AVP - IT Audit (Cloud, IT infrastructure & Cybersecurity)

The AVP IT Audit is a technical audit lead role within the global Internal Audit function, responsible for executing independent, objective assurance activities to evaluate the effectiveness of the organization’s governance, technology risk management, and internal control environment.

Reporting directly to an Audit VP or Director, you will independently own and deliver the end-to-end audit lifecycle—from scoping and walkthroughs to fieldwork execution, standalone workpaper documentation, reporting, and issue remediation—across cloud, network security, Active Directory, and AI governance domains.

Key Responsibilities

• Audit Lifecycle Execution: Lead walkthrough meetings and interviews with business and technical stakeholders to understand architecture, evaluate processes, identify risks, and establish audit scopes and testing programs.
• Control Testing & Evaluation: Evaluate the design and operating effectiveness of technical infrastructure controls, identifying control weaknesses and assessing business impact.
• Workpaper Excellence: Prepare standalone, high-quality audit workpapers and detailed lead sheets describing tested control attributes and findings in a clear, re-performable manner.
• Methodology & Regulatory Alignment: Maintain strict adherence to internal audit methodologies, professional auditing standards, and applicable global banking regulatory expectations.
• Emerging Tech & AI Risk: Audit artificial intelligence applications and emerging technology frameworks, evaluating model lifecycle governance, data protection, prompt security, and AI risk controls.
• Stakeholder Management & Issue Resolution: Present audit findings and risk implications to Audit Management and business stakeholders, negotiate actionable remediation plans, and validate issue closure.

Technical Domains & Scope

Candidates are expected to possess strong working knowledge and hands-on auditing experience across the following technical pillars:

1. Cloud & Emerging Technologies: Cloud security architecture, Cloud Security Posture Management (CSPM), Privileged Access Management (PAM), Zero Trust architecture, and Artificial Intelligence governance frameworks.
2. Network Security Infrastructure: IP network topology, switches, routers, firewalls, and Intrusion Detection / Prevention Systems (IDS/IPS).
3. Identity & Access Management (IAM): Windows Active Directory, Azure AD, and LDAP policies, structure, Group Policy Objects (GPOs), and privilege management.
4. Databases & Storage: SQL, Oracle, DB2, and database security parameter/access monitoring tools.
5. Endpoint & Data Protection: Mobile Device Management (MDM), Data Leakage Prevention (DLP), and Bring Your Own Device (BYOD) security controls.
6. Governance Standards: Direct application of industry standards including CoBIT 5, ITIL, NIST CSF, and NIST AI RMF.

Required Qualifications & Experience

• Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, or related technical discipline.
• Professional Certifications: CISA (Certified Information Systems Auditor) required or strongly preferred; CISM, CISSP, or ISO 42001/27001 certifications are an added advantage.
• Experience: Minimum of 5+ years of direct experience in internal audit, IT infrastructure audit, or technology risk management within Financial Services, Investment Banking, or Big 4 Tech Risk consulting practice.
• Analytical & Soft Skills: Professional skepticism, strong critical thinking, written/verbal negotiation skills, and proficiency in audit data analytics tools (e.g., SQL, Alteryx) and MS Office tools