IT, Security and Internal Control Audit Analyst

We are seeking an IT, Security and Internal Control Audit Analyst to support the planning, execution, and reporting of IT audits, information security assessments, and internal control assurance activities. The role is responsible for evaluating the effectiveness of IT and security controls, identifying technology and cybersecurity risks, assessing compliance with internal policies and industry standards, and providing practical recommendations to strengthen the organization's control environment.

The successful candidate will work closely with IT, Information Security, Risk, Compliance, Internal Audit, business stakeholders, external auditors, and third-party service providers to ensure technology risks are effectively identified, monitored, and managed.

Key Responsibilities

IT Audit & Security Assurance

• Support the planning and execution of IT audits, information security reviews, and technology assurance activities.
• Assess the design and operating effectiveness of IT General Controls (ITGCs) and security controls.
• Perform testing of controls related to:
• User access management
• Change management
• IT operations
• Backup and recovery
• Incident management
• Vulnerability management
• Data protection and security
• Review IT processes, policies, procedures, system configurations, and supporting documentation to identify control weaknesses and risks.
• Collect, analyze, and document audit evidence in accordance with established audit and internal control methodologies.
• Identify control deficiencies, root causes, risk implications, and improvement opportunities.
• Prepare clear, concise, and actionable audit findings and recommendations.
• Support remediation tracking and validation of corrective action plans to ensure timely issue closure.

Risk Assessment & Monitoring

• Conduct technology risk assessments for applications, infrastructure, systems, processes, and third-party vendors.
• Support the maintenance and enhancement of the IT risk register.
• Monitor and evaluate Key Risk Indicators (KRIs) and emerging technology risks.
• Prepare risk dashboards, reports, and analytical insights for leadership and management.
• Assist in identifying trends, recurring issues, and areas requiring enhanced controls.

Governance, Compliance & Policy Management

• Assist in the development, review, and maintenance of IT policies, standards, procedures, and control frameworks.
• Support compliance with regulatory requirements, internal governance standards, and industry best practices.
• Participate in governance reporting and technology risk presentations.
• Assist stakeholders in understanding and addressing compliance requirements.
• Support internal and external audit activities and regulatory reviews.

Continuous Improvement

• Recommend enhancements to IT control frameworks, audit methodologies, and security assurance processes.
• Identify opportunities to improve the effectiveness and efficiency of control testing and risk monitoring activities.
• Stay informed about emerging cybersecurity threats, technology risks, regulatory developments, and industry trends.
• Contribute to strengthening risk awareness and control culture across the organization.

Qualifications

Education

• Bachelor's Degree in:
• Information Technology
• Cybersecurity
• Computer Science
• Risk Management
• Internal Audit
• Or a related discipline

Experience

• Minimum 2–5 years of relevant experience in:
• IT Audit
• Information Security
• Internal Controls
• Technology Risk
• Cybersecurity Governance
• Hands-on experience performing:
• IT control testing
• Security assessments
• Risk assessments
• Compliance reviews
• Experience working within financial services, insurance, banking, or highly regulated industries is an advantage.

Technical KnowledgeRequired

• Strong understanding of:
• IT General Controls (ITGC)
• Access Management
• Change Management
• Vulnerability Management
• Incident Management
• IT Operations Controls
• Backup and Recovery Controls
• Data Protection and Security Controls
• Familiarity with IT risk management and control frameworks.
• Experience reviewing policies, procedures, process documentation, and technical configurations.
• Understanding of cybersecurity principles, risks, and control environments.

Preferred

• Knowledge of industry frameworks and standards such as:
• ISO 27001
• COBIT
• NIST Cybersecurity Framework
• Professional certifications are advantageous:
• CISA
• CISSP
• CRISC
• CISM

Benefits:

• Company events
• Health insurance
• Life insurance

Application Question(s):

• How much is your asking salary?

Work Location: In person