IT Audit Manager within PASHA Bank (ITEC)

• Ensures the compliance of the operation of the Internal Audit Department with the Annual IT Audit Plan and budget.

• Ensures that IT audit projects are implemented in line with the programs developed in accordance with internal audit standards (IIA, ISACA, NIST);
• Supports efficient professional interaction with the Management and other structural units (committees, departments, functions, etc.).
• Evaluates the effectiveness of Risk Management, and internal corporate governance controls subject to the scope of work of IT audit projects;
• Overseeing the work performed by employees as part of IT audit projects under his/her supervision;
• Develops reports and provides feedback on the outcomes of IT audit projects;
• Approves risk assessment criteria for database-based audit projects as required by IT audit standards;
• Takes part in the testing of the Sustainable Action Plan of the Company and provides feedback on the efficiency of the process;
• Evaluates the overall sustainability and security of the IT structure in the Company;
• Gives opinion on the IT maturity of the Company on the basis of IT-related audit projects, special audit projects, and penetration tests.
• Participating in the drafting of policies, procedures and methodologies supporting the operation of the Internal Audit Department;
• Participating in the planning of IT budget which is part of the internal audit department's budget;
• Participating in Annual IT Audit Planning;
• Coordinating the audit of IT-related processes, monitoring the audit and special audit projects as instructed by the Director of the Internal Audit Department and in accordance with the Annual Audit Plan;
• Rendering technical assistance for the audits of non-IT processes in accordance with the Annual Audit Plan and as instructed by the Director of the Internal Audit Department;
• Overseeing the implementation and budget of IT audit projects, taking main IT, information security and cyber security risks into account;
• Overseeing the completeness, accuracy and timely submission of the reports of IT audit project;
• Monitoring the implementation of action plans developed by the Management in order to address the identified issues and shortcomings;
• Supporting the implementation and coordination of external audits and other independent audits;
• Participating in the drafting of summary reports related to the activities of the Internal Audit Department;
• Overseeing the accuracy and efficiency of the Retain Management report of the Internal Audit Department;
• Establishing Key Performance Indicators (KPIs) and development plans for the employees under his/her supervision;
• Conducting performance appraisal of employees under his/her supervision;
• Providing training, guiding and counseling the employees under his/her supervision;
• Assessing Control Objectives for Information and Related Technologies (COBIT) as instructed by the Director of the Internal Audit Department;
• Fulfilling other tasks assigned by the Director of the Internal Audit Department within his/her competence.

Requirements

• Academic degree in the relevant field (Bachelor’s degree and above);
• Related work experience: more than 7 years in IT Risk Management, IT audit and Information Security;
• Expertise in IT and internal audit;
• Having knowledge in IT, relevant area and business processes for implementing audit procedures;
• Knowledge of regulatory and legal documents developed by the state executive body regulating the company’s area of activity;
• Strong analytical and communication skills;
• Technical knowledge: network and network security. Ability to work with MS Windows and Linux based operating systems. Knowledge of databases and information security. Knowledge of data analytics. QL and PowerShell scripts, ITGC, Metasploit;
• Coding: Python, SQL, PowerShell, Java scripting;
• Standards: Internationally accepted IT and IS standards - ISO/IEC 22301, ISO/IEC 270005, PCI DSS, NIST; COBİT, ITIL;
• Pentest methodology - OWASP, OSSTMM, PTES
• Knowledge of regulatory and legal documents developed by the state executive body regulating IT and information systems in the banking/insurance field;
• Certifications: CISA, CISM, CISSP.