QNB3900 - Associate, IT Application Audit (Qatarization)

Role overview

Audit work

• Contribute to risk-based audit planning and assess significant IT and cybersecurity risks, technology processes, and IT investments.
• Participate in audits covering infrastructure, applications, data management, network security, access controls, incident response, and business continuity.
• Support audit planning, risk assessments, auditee interviews, and documentation of scope and work programs.
• Conduct assigned testing, prepare progress updates, draft evidence-based findings and recommendations, and present findings to auditees.
• Validate issue closures, escalate delays, and complete audit file closure procedures.
• Assess IT controls, information security frameworks, IT governance, and disaster recovery capabilities.
• Identify technology control weaknesses, cybersecurity vulnerabilities, and operational inefficiencies and recommend corrective actions.
• Support audit analytics and continuous auditing to improve risk identification and provide timely assurance.

Education, skills, and experience

• A university degree is preferred, ideally in Information Technology, Computer Science, Cybersecurity, Business Administration, or a related field; a master's degree is preferred.
• CISA or CIA is preferred. CISSP, CISM, CRISC, and relevant cloud certifications are highly desirable.
• Strong analytical, critical-thinking, problem-solving, communication, report-writing, interpersonal, and presentation skills.
• Ability to translate technical issues into business risks and work independently and collaboratively with integrity and professional skepticism.
• Excellent oral and written English is required; Arabic is preferred.
• Understanding of relevant laws, regulations, and practices, with planning, organization, decision-making, and self-management ability.

Standards and compliance

• Perform audits in accordance with the GIAD Group Audit Manual, IIA standards, relevant ISACA standards, and applicable local regulations.
• Comply with applicable legal, regulatory, internal compliance, data protection, cybersecurity, and information security requirements.
• Support risk management practices including Three Lines of Defence, RCSA, KRI, incident reporting, and remediation.

Stakeholder and professional responsibilities

• Maintain working relationships with business and support functions, internal and external auditors, consultants, and regulators.
• Provide timely information to auditors, Compliance, Financial Control, and Risk when required.
• Stay current with IT trends, evolving cyber threats, professional developments, and data analytics and continuous auditing techniques.
• Maintain confidentiality, data protection, professional standards, and QNB's reputation.

Application documents

• The posting requests a resume or CV and copies of a passport or QID, education certificate, and birth certificate.