Assistant Manager - IT Controls

We are recruiting for a Assistant Manager in the Internal Audit & Controls Team under Managed Services. Working as a Assistant Manager in this team, your responsibilities will include:

Key Responsibilities

• Perform end-to-end control testing across domain like cyber and privacy controls
• Conduct walkthroughs, identify control attributes, and assess control design and operational effectiveness
• Review evidence, document test results, and identify control deficiencies or gaps
• Support development and maintenance of Risk and Control Matrices (RACMs)
• Collaborate with engagement teams and stakeholders to drive timely completion of testing deliverables
• Ensure documentation meets audit and quality standards

Additional skillset needed

• Demonstrate working knowledge of cybersecurity and privacy domains such as:
  • Identity & Access Management
  • Data Protection
  • Network Security
  • Logging & Monitoring
• Apply understanding of NIST Cybersecurity Framework (CSF) to map and assess controls
• Understanding of COBIT, GDPR governance and ISO27001.
• Experience with applications/ tools like CyberArk, Sailpoint, Github, AWS and GCP.
• Support cyber maturity assessments and control benchmarking where required

Required Skillset

Core Skills (Mandatory)

• 5-7 years of strong experience in IT Audit / Technology Risk / Control Testing
• Hands-on experience in:
  • ITGC testing (Access, Change Management, Operations)
  • Control documentation and evaluation
• Good understanding of control testing lifecycle (design and operating effectiveness)
• Familiarity with audit tools, documentation standards, and testing methodologies

Cybersecurity (Preferred / Secondary)

• Working knowledge of NIST Cybersecurity Framework
• Basic exposure to cybersecurity control domains and risk concepts
• Understanding of frameworks like ISO 27001, COBIT (good to have)

Qualifications

• Bachelor's degree in Technology / Engineering / Commerce or related field
• Professional certifications (preferred but not mandatory):
  • CISA, CISSP, ISO 27001 LA, or equivalent