Senior Information Technology Auditor

About the role

The Senior Information Technology Auditor will lead technology and cyber‑security audits, providing independent assurance that IT risks are managed and regulatory requirements are met. You will work closely with management to evaluate governance, controls, and resilience across the organization’s digital environment.

Key responsibilities

• Plan and execute technology and cyber‑security audits in line with the annual audit plan.
• Assess design and operating effectiveness of IT general controls (ITGCs) and application controls.
• Review cyber‑security governance, identity and access management, network, endpoint and cloud security, vulnerability management, incident response and security monitoring.
• Evaluate IT infrastructure, databases, operating systems, cloud platforms and disaster recovery/business continuity controls.
• Verify compliance with regulatory frameworks such as SAMA Cyber Security Framework, NCA ECC, ISO 27001 and NIST.
• Perform risk assessments, identify control gaps and recommend practical improvements.
• Prepare audit working papers, reports and presentations for senior management.
• Follow up on findings and validate implementation of action plans.
• Support investigations, special reviews and advisory engagements related to technology risk.

Required profile

• Bachelor’s degree in Computer Science, Information Technology, Cyber Security, Information Systems or a related field.
• 7–10 years of experience in IT audit, cyber‑security audit, information security or technology risk.
• Professional certifications (e.g., CISA, CISSP, CRISC) are preferred.
• Experience in banking, financial services or other regulated environments is highly preferred.

Required skills

• IT general controls
• Application controls
• Identity and access management
• Network security
• Endpoint security
• Cloud security
• Vulnerability management
• Incident response
• Security monitoring
• IT infrastructure
• Databases
• Operating systems
• Cloud platforms
• Disaster recovery
• Business continuity