Manager/Senior Manager - Information Security Audit/IT Audit - Online Payment Firm

- To carry out IS Audit planning using the Risk Based Audit Approach. The approach would involve aspects like IT risk assessment methodology, defining the IS Audit Universe, scoping and planning the audit, execution and follow up activities.

- To ensure IS Audit Plan (either separately or as part of the overall internal audit plan) be a formal document, duly approved by the Audit Committee initially and during any subsequent major changes. The Audit plan to be prepared in compliance with appropriate external regulatory/legal requirements, in addition to well-known IS Auditing Standards.

- Would be responsible for follow up and closure on ATR

- To implement IS Audit policy/charter subjected to an annual review/approval to ensure its continued relevance and effectiveness.

- To build the IS Audit Universe around various IT people and processes like application systems, information or data, infrastructure (technology and facilities like hardware, operating systems, database management systems, networking, etc., and the environment that houses and supports them that enable the processing of the applications) and people (internal or outsourced personnel required to plan, organize, acquire, implement, support, monitor and evaluate the information systems and services).

- To finalize annual IS Audit Plan and strategy which is prepared based on the scoping document and risk assessment.

- To report on the status of planned versus actual IS audits, and any changes to the annual IS audit plan (to be presented periodically to the Audit Committee and Senior management)

- To cover IT governance, information security governance related aspects, critical IT general controls like data center controls and processes and critical business applications/systems having financial/compliance implications including MIS and regulatory reporting systems and customer access points (like delivery channels)

- To establish a quality assurance process (e.g., interviews, customer satisfaction surveys, assignment performance surveys etc.) to understand the auditee's needs and expectations relevant to the IS audit function.

- To include pre and post implementation application control audits and data migration audits with regard to critical systems.

- To consider Fraud Vulnerability assessments undertaken by the Fraud Risk Management group, while identifying fraud risk factors as part of IT risk assessment and audit process.

- To consider tools and techniques that help support the audit procedures to increase the efficiency and effectiveness of the audit.

- To include branches, in critical areas like password controls, control of user ids, operating system security, anti-malware controls, maker-checker controls, segregation of duties, rotation of personnel, physical security, review of exception reports/audit trails, BCP policy and testing etc. (as applicable)

- To enhance utilization of CAATs

- To include Services provided by a third party when those services, and the controls within them, form part of the bank's information systems. These need to be adequately assessed as part of the IS Audit process.

Demonstrate (Key competencies)

- To possess the relevant knowledge of Information Systems, IS Controls and leading audit practices

- To have relevant competencies to understand the ultimate impact of deficiencies identified in IT Internal Control framework as part of IS audits.

- He/or she to act independently of the bank's management.

- To be professionally competent, having the skills, knowledge, training and relevant experience to conduct an audit.

- To be able to exercise due professional care, which includes following professional auditing standards in conducting the audit.

- To be reasonably conversant with various fraud risk factors and should assess the risk of occurrence of irregularities connected with the area under IS audit.

Educational Level : Master's Degree in Business, Finance, Accounting or any relevant professional qualification. CISA/ or DISA certified

Working Experience : 5+ years of work experience in Auditing in large to mid-size organization for Information security. Banking experience preferred