Senior Auditor, IT (Digital Infrastructure)

Job Purpose

Internal Audit Plan

• Develop the audit universe to ensure it covers Digital Infrastructure and cybersecurity risks in line with the other D&T risk areas like (Digital governance, OT, process, applications, technology interface, and emerging technologies) that could affect the ADNOC Business operations.
• Review and update the D&T audit universe specifically for Digital Infrastructure and Network.
• Develop and implement strategic initiatives (e.g. Infrastructure Assurance Plan etc.) that impact the group-wide audit plans and oversee the execution to ensure it fulfills the objectives.

Audit Execution

• Perform audits, advisory engagements, and other influencing activities in highly technical areas of current/emerging technologies within ADNOC and Group Companies.
• Develop a detailed audit program / Risk & Control Matrix (RCM) for the assigned audit, including the objectives, potential risk, key controls, audit procedures, and the use of audit techniques and tools to evaluate governance, risks, and controls processes, and submit audit program to the management for review and approval.

Job Specific Accountabilities (Part 1)

• Ensure that adequate working papers and all relevant information are continuously documented and updated in the automated Audit Management System in accordance with pre-defined templates and audit procedures.
• Ensure that approved audit objectives have been met with adequate coverage of all relevant areas and sufficient audit evidence is obtained to support the conclusion and recommendations in accordance with professional audit standards.

Audit Reports

• Prepare an audit report with a conclusion, expressing professional opinions on the adequacy and effectiveness of risk management, control systems, and the efficiency with which activities are carried out. Recommend improvement options to rectify reported deficiencies for Department Manager’s review.
• Recommend practical enhancements in Digital and Technology governance, risks, and control processes to assist in the achievement of the company's business objectives.

Coordination

• Assist in the periodic reporting to the Audit Committee and Senior Management on Technology audit activities, performance, significant risk exposures, controls/governance issues, and other related matters within ADNOC and Group Companies within ADNOC and Group Companies.

Minimum Qualification

**Minimum Experience, Knowledge & Skills**

• 8-10 years of relevant experience in D&T or IT internal auditing, and a minimum of 5+ years of work experience in Digital Infrastructure and cybersecurity domain.
• Advance technical knowledge of core infrastructure, network components (routers, switches, firewalls etc.), cloud security, different operating systems, databases, virtualization technologies and security operations.
• Sound knowledge coupled with extensive experience in technology-related risks in emerging areas such as Cloud, Internet of Things (IoT), Zero-Trust / Defense In-Depth architecture, Identity and Access management, digitalization, automation etc.
• Strong hands-on experience in conducting vulnerability assessments / penetration testings at infrastructure, network, and system layers. Bug bounty hunting would be an added advantage.

Minimum Experience, Knowledge & Skills

• Exposure in reviewing infrastructure platforms hosting AI/ML solutions to assess related risks, security controls, and governance aspects across the AI technology stack would be an advantage.
• In-depth knowledge of Digital processes, including, but not limited to, business continuity and disaster recovery, enterprise architecture, infrastructure review (on-prem and cloud), access-right management, change management and DevOps etc.
• In-depth knowledge of International Professional Practices Framework for IT Assurance/IT Assurance Framework (ITAF) and other related frameworks/standards (e.g. COBIT, ITIL, ISO27000, ISO22301 NIST) and their interpretation/application to IS/IT auditing practice.
• Experience in managing and tracking time for different Internal Audit-related activities.
• Expertise in collecting and analyzing complex data using data analytics tools, evaluating information and systems, and drawing logical conclusions
• Extensive knowledge of planning and project management areas
• Awareness/knowledge of ERP and Operational Technology (OT) processes and systems. (preferred.

Professional Certifications

• IT audit certification, CISA, is mandatory or willing to obtain within one year of joining.
• Other related certifications (GIAC, CISSP, OSCP, CISM, etc.) are preferred.
• Technical certifications (CCNA, CCIE, , Azure, CCSK / CCSP, GPENetc.) are desirable.