Information Technology Auditor

Position Overview

The Information Technology Auditor plays a pivotal role within the Internal Audit function, delivering independent and objective assurance over IT systems, cybersecurity controls, and digital transformation initiatives. This position is instrumental in evaluating the robustness of IT governance frameworks, information security protocols, cyber resilience measures, and technology-enabled processes to ensure full alignment with regulatory mandates, organizational policies, and strategic imperatives. By identifying control deficiencies and recommending enhancements, the role strengthens the organization’s risk management posture, fosters trust in digital services, and supports sustainable operational excellence.

Core Responsibilities

The Information Technology Auditor is tasked with a diverse portfolio of responsibilities, structured around the following key pillars:

1. IT & Cyber Audit Execution

This role is responsible for planning and executing comprehensive IT and cybersecurity audits in strict accordance with the approved audit plan and established internal audit methodologies. The position involves a thorough assessment of General IT Controls (ITGCs), application controls, and cybersecurity frameworks across diverse systems, platforms, and technological infrastructures. The auditor ensures compliance with globally recognized standards and regulatory frameworks, including but not limited to the National Cybersecurity Authority (NCA) guidelines, ISO 27001, and COBIT. Key activities include:

• Conducting end-to-end IT and cyber audit engagements with a focus on risk identification and control evaluation.
• Reviewing IT governance structures, security controls, and adherence to applicable regulatory and industry standards.
• Assessing the effectiveness of risk mitigation strategies and identifying systemic control weaknesses.
• Collaborating with cross-functional teams to gather evidence and validate control implementations.

2. Audit Reporting & Follow-up

The Information Technology Auditor is accountable for producing clear, concise, and actionable audit reports that articulate observations, root causes, inherent risks, and pragmatic recommendations. The role includes tracking the implementation of management action plans and verifying the timely and effective resolution of identified issues. Responsibilities encompass:

• Developing comprehensive audit reports that highlight critical findings and provide strategic remediation guidance.
• Monitoring the progress of corrective actions and validating the closure of audit issues in alignment with agreed timelines.
• Engaging with senior management and stakeholders to present audit findings and facilitate informed decision-making.

3. Stakeholder Management & Advisory Support

This position requires active engagement with IT, cybersecurity, and business stakeholders to gain a deep understanding of systems, processes, and evolving risk landscapes. The auditor provides advisory input on control design for new systems, digital initiatives, and major IT projects, ensuring robust risk management from inception. Key activities include:

• Building collaborative relationships with key stakeholders to facilitate audit execution and information sharing.
• Offering expert guidance on IT control design, cybersecurity best practices, and regulatory compliance during system development and implementation phases.
• Facilitating workshops and training sessions to enhance awareness of IT risks and control requirements across the organization.

4. Continuous Improvement & Professional Development

The Information Technology Auditor is expected to maintain a forward-looking perspective by staying abreast of emerging technologies, evolving cyber threats, regulatory changes, and advancements in audit methodologies. The role contributes to the ongoing enhancement of IT audit tools, techniques, and frameworks to ensure alignment with industry best practices. Responsibilities include:

• Monitoring industry trends, regulatory updates, and technological advancements to inform audit strategies.
• Participating in professional development initiatives to acquire new skills and certifications relevant to IT audit and cybersecurity.
• Innovating audit approaches to leverage advanced analytics, automation, and data-driven techniques for improved risk assessment and control evaluation.

Qualifications & Competencies

Educational Background

• A Bachelor’s degree in Information Technology, Computer Science, Information Systems, Cybersecurity, or a closely related discipline is required.

Professional Experience

• A minimum of three to five years of progressive experience in IT audit, cybersecurity, risk management, or technology assurance is essential.
• Prior exposure within government agencies, regulated industries, or large-scale organizations is highly advantageous.

Professional Certifications

• Certified Information Systems Auditor (CISA) is mandatory.
• Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), or ISO 27001 Lead Auditor/Implementer certifications are highly desirable.

Technical & Functional Skills

• Expertise in General IT Controls (ITGCs), cybersecurity frameworks, and risk assessment methodologies.
• Proficiency in evaluating controls across cloud platforms, digital environments, and enterprise systems.
• Strong understanding of Identity and Access Management (IAM), data protection, and privacy controls.
• Familiarity with Governance, Risk, and Compliance (GRC) tools and audit analytics platforms.

Soft Skills & Attributes

• Exceptional analytical and critical thinking capabilities to dissect complex IT environments and identify control deficiencies.
• Outstanding written and verbal communication skills to articulate technical findings to diverse audiences.
• Proven ability to manage stakeholders, build consensus, and foster collaborative relationships across departments.
• Meticulous attention to detail and sound professional judgment to ensure audit integrity and reliability.