Information Security Audit Officer

The Information Security Audit Officer is responsible for conducting internal audits in accordance with ISO 27001, SOC, ITGC and other relevant standards.

1. Key Responsibilities

· Plan and execute information security audits in accordance with the ISO 27001, SOC, ITGC and other relevant standards.

· Review and evaluate the effectiveness of security controls, policies, and procedures.

· Identify vulnerabilities, risks, and areas for improvement in security operations.

· Prepare detailed audit reports, highlighting findings and recommendations for mitigation.

· Collaborate with the Information Security Compliance Officer to address audit findings and verify corrective actions.

· Monitor local adherence to security standards and frameworks.

· Provide feedback to the Information Security Department to improve audit methodologies and tools.

· Stay informed about information security standards, laws, regulations and policies affecting information security.

2. Key Result Areas

· Audit Planning & Execution

o Percentage of audits completed vs. planned in the audit program.

o Percentage of audits conducted on schedule.

· Control Evaluation

o Percentage of critical controls reviewed annually.

o Percentage of controls assessed as effective vs. ineffective.

o Number of improvement opportunities identified and actioned.

· Findings & Reporting

o Average turnaround time to issue audit reports after fieldwork.

o Percentage of reports accepted without major revisions.

o Percentage of findings classified by severity

· Follow-up & Corrective Action Verification

o Percentage of findings closed within agreed timelines.

o Percentage of overdue findings escalated to management.

· Audit Methodology & Process Improvement

o Number of improvements suggested/implemented in audit methodology.

o Auditor efficiency rating (audits completed per quarter).

o Positive feedback from management on audit quality.

3. Qualifications and Experience

· Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field; professional certifications such as ISO/IEC 27001 Lead Auditor, CISA, or CISSP are preferred.

· Minimum 3-5 years of experience in information security auditing, compliance, or IT governance roles, with hands-on experience conducting audits aligned with ISO/IEC 27001, SOC 2, and IT General Controls (ITGC).

· Proven understanding of information security controls, risk management principles, and compliance frameworks.

· Demonstrated ability to plan and conduct localized security audits, evaluate the effectiveness of existing controls, and document audit findings and recommendations clearly and accurately.

4. Key Competencies and Skills

· Strong understanding of information security principles, risk management, and control frameworks.

· Analytical and problem-solving skills.

· Excellent communication and documentation skills.

· Ability to work independently and collaboratively with cross-functional teams.

· Attention to detail and commitment to continual improvement.