Information System Auditor

Position - IS Auditor

Function - Information Systems Audit, Cybersecurity Audit, GRC

Reports to - Senior IS Auditor / Engagement Project Manager

Base location - Dadar, Mumbai — organisation's primary office

Experience - 3–4 years in IS / systems and security audit, preferably with banks, financial institutions or regulated financial-sector organisations

Engagement - Three-year assignment, covering annual Systems Audit and quarterly IT Systems and Security Audit (ITSSA) plus post-implementation verification

Role Summary

You will independently execute assigned audit areas across a multi-year Systems Audit and ITSSA engagement for a regulated financial-sector organisation — testing controls for design and operating effectiveness, writing observations, and carrying them through to closure — working under the direction of a Senior IS Auditor or the Project Manager.

Systems Under Audit

· IT infrastructure at the organisation's primary site — this role's audit coverage; other sites (near-DR, far-DR, alternate user locations) are covered separately by the engagement team.

Core regulated systems: clearing/settlement or transaction-processing systems and ancillary applications, risk management systems, funds/payment settlement systems interfacing with banking/settlement infrastructure, and any trade or transaction repository in scope.

Other business applications: the organisation's member/customer-facing portals, internal reporting and dashboard applications, and risk/collateral management tools as defined in the engagement scope.

Electronic trading/dealing platforms and any overseas subsidiary or group-entity systems, as applicable to the organisation's structure, each assessed for IT infrastructure and application-level controls.

Key Responsibilities

Audit execution: test assigned control areas (from the domains and ITSSA focus areas below) for both design and operating effectiveness, gather and evaluate evidence, and draft clear, evidence-backed observations.

Domain coverage: access control, hardware and asset management, network and perimeter security, data security, physical/environmental security, HR security, change and patch management, log management, backup and restoration testing, capacity management, database security, BCP/DR review.

ITGC audit: conduct IT General Controls (ITGC) audits covering access-to-program/data (user provisioning, de-provisioning and periodic access recertification), change management, program development/system implementation, computer operations (job scheduling, batch processing, backup) and IT governance controls — testing both design and operating effectiveness and tying each control to the relevant financial/business process it supports.

Application and vendor reviews: support application security reviews (API inventory, S-SDLC, VA/PT and source-code review evidence), and carry out third-party/vendor audit visits as assigned (up to 5 vendor locations per cycle).

Internal IT infrastructure audit: independently plan and conduct internal audits of IT infrastructure — servers, network and security devices, databases, endpoints, and physical/environmental controls — across all domains covered in the engagement scope (Systems Audit and ITSSA alike), not just areas assigned for external reporting.

Quarterly ITSSA cycle: own 3–4 of the rotating 8–10 focus areas each quarter and deliver draft findings in time for the Senior IS Auditor's review and the 10-day post-quarter reporting deadline.

Reporting and closure: reference every observation to the relevant ISO 27001:2022 Annex A clause with severity, impact/risk and recommendation; track prior-audit observations to confirm sustained closure; carry out post-implementation verification within one month of report submission.

· Working papers: maintain complete, audit-ready evidence files and status trackers for every area you own.

Required Qualifications

Certification: CISA (ISACA) or DISA (ICAI) preferred and strongly weighted; candidates actively pursuing CISA/DISA with strong audit fundamentals will also be considered, since sign-off responsibility sits with the Senior IS Auditor.

Education: B.E./B.Tech/MCA/M.Sc. (IT/Computer Science/Electronics) or CA/equivalent professional qualification.

Experience: 3–4 years in IS audit, IT risk or GRC; exposure to banks, financial institutions or financial market infrastructure entities preferred.

Standards knowledge: working familiarity with ISO/IEC 27001:2022 Annex A, ITGC frameworks (COBIT-aligned access, change and operations controls), RBI IS/IT audit expectations and the PSS Act 2007.

Audit capability: demonstrated ability to independently conduct internal IT infrastructure audits (governance, access control, network, data, physical/environmental, HR security, BCM, vendor risk, and the other domains listed above) across all areas covered in the engagement scope, not just a single specialisation.

Independence: no engagement, direct or through the firm, with the audited entities in the last two financial years; willing to sign an independence certificate and an individual NDA.

Technical Skills

Working knowledge of Windows Server/Unix-Linux environments, firewall rule review, SIEM/syslog basics, PIM/PAM concepts, endpoint/DLP tooling, and VA/PT report interpretation.

Comfortable with audit working papers, evidence management, and advanced MS Excel and Word.

Pay: ₹600,000.00 - ₹800,000.00 per year

Application Question(s):

• Where do you reside?
• What is your Current CTC?
• What is your Expected CTC?
• What is your Notice Period?

Work Location: In person