Assistant Manager - IT Audit

Position Title 

Assistant Manager/Manager 

Department 

Internal Audit

Level/ Band 

Reports To 

AVP / Sr. Manager Internal Audit 

Supervises 

Individual contributor

Geographic Area Covered 

Pan - India. All Departments 

Internal Stakeholders 

Head of Audit

Senior Management / All Departments - management categories 

External Stakeholders 

NA

· Perform risk-based IT audits across Infrastructure, Applications, Information Security, Cyber Security, Cloud, Data Management, Third-Party Risk, and Emerging Technology domains as per the approved audit plan. 

· Lead end-to-end audit engagements, including audit planning, scope discussions, kick-off meetings, walkthroughs, risk assessments, fieldwork, control testing, stakeholder interactions, reporting, and audit closure. 

· Review previous audit reports and validate closure of outstanding audit observations and management action plans. 

· Prepare Risk Assessment Matrices (RAM), identify key risks and controls, and develop audit programs aligned with business, technology, and regulatory risks. 

· Assess and audit IT General Controls (ITGCs) across applications, operating systems, databases, network infrastructure, Active Directory, middleware, and virtualized environments, covering Access Management, Change Management, IT Operations, and IT Service Management controls. 

· Perform IT Application Controls (ITAC) reviews, including automated controls, interface controls, workflow controls, configuration controls, report controls, and system-generated reports. 

· Assess Cyber Security governance and operational controls, including SOC operations, SIEM monitoring, vulnerability management, incident response, threat monitoring, endpoint security, and cyber resilience programs. 

· Perform audits of Data Security controls, including data classification, encryption, data loss prevention (DLP), data retention, backup security, and protection of sensitive customer information. 

· Evaluate Third-Party and Outsourcing Risk Management controls in line with organizational policies, Information Security standards, and IRDAI requirements. 

· Assess compliance with IRDAI Information & Cyber Security Guidelines, Technology Governance requirements, Operational Resilience expectations, and other applicable regulatory obligations. 

· Perform compliance, substantive, and control effectiveness testing to assess the adequacy, design, and operating effectiveness of key controls and identify areas of improvement. 

· Prepare and maintain audit workpapers, testing documentation, observations, conclusions, and supporting evidence in TeamMate (TM) in accordance with audit methodology and quality standards. 

· Identify control gaps, process weaknesses, compliance deviations, and emerging risks; recommend practical remediation actions and process improvements. 

· Discuss audit observations with business and technology stakeholders, validate factual accuracy, obtain management responses, and draft audit reports as per Internal Audit methodology. 

· Present audit findings to audit management, support quality assurance reviews, monitor remediation progress, track closure of audit observations, and participate in special reviews, fraud investigations, business continuity, contingency planning, and risk mitigation initiatives. 

· Participate in risk mitigation plans, contingency planning, business continuity programs by executing and reporting within defined timelines. Highlight and recommend process gaps, flaws and process changes. 

Technical 

• Strong knowledge of IT Internal Audit methodologies (IIA Standards), risk-based auditing, control testing, and audit documentation. 
• Hands-on experience in IT Audits, ITGC, ITAC, Cyber Security, Data Security, Cloud Security, Network Security, and BCP/DR reviews. 
• Good understanding of Operating Systems, Databases, Active Directory, Applications, Middleware, Network Infrastructure, and IT Service Management controls. 
• Experience in auditing Identity & Access Management (IAM/PAM), Cloud Security (Azure/AWS/GCP), DevSecOps and Secure SDLC controls. Knowledge of Data Governance, Data Privacy, Operational Resilience, and Disaster Recovery frameworks. Familiarity with AI/Generative AI risks, emerging technology audits, and advanced data analytics for continuous 
• Experience in assessing compliance with IRDAI Information & Cyber Security Guidelines, NIST CSF, ISO 27001, ISO 22301, COBIT, CIS Controls, and related technology risk frameworks. 
• Knowledge of SOC, SIEM, Vulnerability Management, Incident Response, Access Management, Change Management, and Third-Party Risk Management. 
• Experience in evaluating technology environments supporting BFSI/Insurance business operations. 
• Proficiency in MS Excel, Word, PowerPoint, TeamMate, Power Bi and data analytics tools. 
• Strong analytical, stakeholder management, report writing, presentation, negotiation, and communication skills. 

Essential 

Essential 

Qualification 

MBA IT/BE/B.Sc IT/M.Tech

Certification in CISA / CISSP / CIA / ISO 27001 / ISO 22301 

Experience 

5 - 8 years in IT Audit

Preferably in life insurance / financial / BFSI services sector/ BIG 4.