Internal Audit

Contribute to the development of risk-based audit plans covering IT and cybersecurity domains.

Perform technology risk assessments across infrastructure, applications, data, cloud environments, and third parties.

Identify priority areas such as SOC operations, identity and access management, data protection, and business continuity.

Conduct IT systems and cybersecurity audits in line with approved methodologies and best practices.

Evaluate the effectiveness of IT General Controls (ITGC) and application controls.

Review cybersecurity controls including access management, encryption, monitoring, vulnerability management, and incident response.

Assess cloud environments, managed services, and outsourced SOC arrangements.

Verify compliance with national regulations and government policies (e.g., DESC ISR and digital government requirements).

Assess alignment with international standards such as ISO/IEC 27001, ISO/IEC 27035, and ISO 22301.

Review organizational readiness for external audits and certifications.

Audit outsourcing arrangements including SOC-as-a-Service, data centers, and cloud providers.

Review SLAs, confidentiality obligations, and independent assurance reports (SOC 1/2).

Validate service providers compliance with contractual and regulatory requirements.

Review cybersecurity incident management, response, and investigation processes.

Evaluate integration between incident response, business continuity, and disaster recovery plans.

Participate in or assess readiness through tabletop exercises and simulations.

Prepare clear and actionable IT audit reports with technical observations, root cause analysis, risk ratings, and recommendations.

Discuss findings with IT, cybersecurity teams, and senior management.

Escalate critical issues to Internal Audit management and Audit Committees as required.

Adhere to approved professional conduct and government ethics requirements.

Maintain confidentiality, independence, and objectivity in all engagements.

Keep abreast of evolving cyber threats, technologies, and regulatory developments.