Senior Manager, Group Internal Audit (IT & Cybersecurity)

Job Summary

The Manager or Senior Manager, IT Audit will be supporting the IT audit function under FPL Group Internal Audit.  The role supports the planning and execution of IT and Cybersecurity audits using a risk-based audit methodology, follow-up on the resolution of audit issues, and validation of control effectiveness following remediation.  The scope of work includes reviews of IT infrastructure, systems, and applications.  This role also supports continuous improvement of the effectiveness and efficiency of Group Internal Audit’s core activities and is expected to provide IT expertise to Business / Operations audits of entities within the Group.  The Manager or Senior Manager, IT Audit may be assigned to General / Operations audits from time to time, where appropriate.

Job Description

• Support the Head of IT Audit in the independent risk assessment of IT infrastructure and applications to formulate the Annual IT Audit Plan.

• Undertake the planning, execution and management of risk-based IT audit projects in accordance with the approved Annual IT Audit Plan.  In addition to the planned projects, special or targeted review projects may be initiated from time to time to cover review of system implementation, applications, and other IT-related risk areas in a timely manner.

• Prepare audit workpapers in accordance with the established documentation standards to support audit results and conclusions.

• Identify process improvement opportunities in each audit project and collaborate with stakeholders to develop value-adding / practical remediation plans.

• Prepare audit reports to communicate results of audits and recommendations to address control lapses, IT and Cybersecurity vulnerabilities or weaknesses in the IT environment, identified during the audits.

• Track and monitor IT and related audit findings raised by Group Internal Audit and the external auditors, where relevant.

• Proactively follow up on risk events, IT incidents, and external audit and regulatory issues observed during the audit or through regular contact with management teams.

• Support development of continuous auditing initiatives using Data Analytics tools within Group Internal Audit and share IT and Cybersecurity knowledge across the staff members.

• Undertake continuous learning and development programs proactively to keep abreast of changes in IT risk landscape, regulatory requirements, and industry standards / best practices.

• Provide support in ad hoc tasks and/or special projects as assigned from time to time.

Key Qualification

Qualifications / Experience

• Degree in Computer Science, Information Systems or equivalent from a reputable tertiary education institute.  Candidates who do not possess the stipulated qualifications but have relevant professional certifications or work experience may still apply.

• Professional certifications such as CISA, CISSP, CISM, etc. 

• Minimum 5 years of experience in IT and Cybersecurity audit (MNC or Big 4 environment).

• Experience with IT audit methodologies and concepts (such as GTAG, COBIT and COSO), including industry best practices and relevant regulatory compliance requirements.

Competencies / Attributes

• Advanced level of ability in using MS Word, Excel, PowerPoint, and relevant applications.

• Knowledge of IT infrastructure security and cybersecurity and processes, covering network devices, system (preferably SAP ERP), database and server platforms.

• Experience in auditing cloud applications and common cloud infrastructure platforms (e.g. Microsoft Azure, Amazon Web Services).

• Knowledge of common technology risks and audit practices.  This includes IT, Cybersecurity and Data governance, IT General Controls (e.g. authentication and authorisation controls, user requirements understanding, application release functionalities validation, security, and control design assessment), management of third-party IT vendors and cloud service providers.

• Knowledge of IT project management.  This includes planning and approval of IT projects, quality controls, user acceptance testing procedures, data conversion and migration, and training and cutover procedures.

• Knowledge of technology risk management guidelines (e.g. MAS TRM) and cyber-related regulations including relevant compliance requirements.

• Good communication (verbal and written) and interpersonal skills.  Able to independently work with all levels of management.

• Willingness to participate in general or operations audits (non-IT audits) including investigative reviews from time to time, as assigned.

• Good project management and organisation skills, with attention to detail.  Willing to work in a fast-paced, deadline-driven environment, accept ownership and accountability of the process, and deliver on commitments.

• Reliable and dedicated self-starter, who can work independently but also interacts well with the team – a team player with a collaborative, “can-do” attitude.