IT GRC Auditor

Role : IT GRC Auditor

Department Objective :

The Information Technology Department is responsible for providing strategic technology direction for the organization, maintenance of IT operational policies and standards, IT project management, development and maintenance of software and applications, ensuring upkeep and updating IT network and Infrastructure and ensuring IT security to the organizations information assets.

Role Objective :

The IT GRC Specialist is a critical role in the IT function of the company. The incumbent will serve as the primary point of contact for all technology-related regulatory audits, compliance programs, and risk assessments. Working directly under the Head of IT, this individual will coordinate, manage, and drive end-to-end audit readiness across multiple regulatory frameworks including the CBUAE, ADHICS, ISO standards, SIA and internal/external audits.

ROLES AND RESPONSIBILITIES :

- Audit Management & Coordination : Serve as the single point of contact (SPOC) for all IT-related audits including CBUAE regulatory inspections, ADHICS assessments, ISO audits (27001, 22301), SIA, and internal/external audits.

- Regulatory Compliance - CBUAE : Ensure alignment with CBUAE IT Risk Circular, Cyber Risk Circular, and all applicable Central Bank regulations for insurance entities.

- ADHICS Compliance : Lead the organisation's compliance with the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) standard.

- ISO Standards : Support the maintenance and continual improvement of ISO certification.

- Internal/External Financial Audits : Coordinate IT General Controls (ITGC) testing for internal/external auditors.

- Governance, Risk & Compliance (GRC) Framework : Maintain and enhance the IT GRC framework including policies, standards, procedures, and control matrices.

- Policy & Control Management : Develop, review, and update IT policies, standards, and procedures in line with regulatory and business requirements.

- Stakeholder Management & Reporting : Prepare executive-level compliance reports, risk dashboards, and board-level GRC presentations.