Assistant Manager/Manager IT Audit, HBFC-Karachi

By House Building Finance Corporation, Karachi                            Qualification:

• Bachelor’s or Master’s degree (16 years equivalent education) in information technology, Finance, Audit, Computer Science, or related field from HEC recognized institutions.
• Professional certification such as Certified Information Systems Auditor (CISA) or similar will be highly preferred.

Experience:

• Experience in financial services industry would be preferred.
• Previous experience in IT auditing, information security, or risk management. Strong research writing & analytical skills.
• Demonstrate strong ethical standards and integrity.
• Familiarity with auditing widely used server, platform, database and end-point technologies.
• Understanding of IT Governance and IT Risk Management concepts.
• Proficiency in audit software, data analytics, and Microsoft Office suit
• Strong understanding of IT systems, networks, and cyber security principles and Knowledge of industry frameworks and standards (e.g., COBIT, ISO 27001, NIST).
• Familiarity with relevant laws and regulations (e.g., ETGRF, SBP Regulations)                                                                                                    

Job Description:

•  Undertake both IT and Operational Audits. Develop full ownership of assigned audit portfolios and establish effective relationships with key personnel in these portfolios in order to stay abreast of changing and emerging risks. Develop and implement the IT audit plan: Collaborate with senior management and the internal audit team to develop a comprehensive IT audit plan that aligns with the organization’s objectives and risk profile. Identify key areas for review, determining audit objectives and scope, and establishing appropriate audit methodologies and techniques.
• Conduct IT audits: Perform detailed assessments of IT systems, processes, and controls to evaluate their effectiveness, identify risks, and detect control deficiencies. Reviewing documentation, conducting interviews, and performing testing of IT controls. 
• Identify and communicate risks: Identify and communicate potential risks associated with the organization’s IT systems and processes. This includes evaluating the impact and likelihood of risks, assessing the adequacy of existing controls, and providing recommendations for risk mitigation.
• Provide recommendations for improvement: Based on audit findings, develop and communicate recommendations to address control deficiencies and improve IT processes. Collaborate with relevant stakeholders to implement remediation plans and monitor progress. Stay informed about IT related threats and trends to ensure the organization’s IT systems remain secure and compliant.
• Audit reporting and documentation: Prepare clear, concise, and accurate audit reports documenting findings, recommendations, and management action plans.
• Ensure that all audit documentation is properly maintained and organized.