1. IT Audit Execution (Infra + Application)
- Conduct audits covering network, servers, cloud, endpoints, databases, IAM, DR/BCP, logging/SIEM, and security controls.
- Perform audits for core insurance applications (Policy Admin, Claims, Underwriting, CRM, Digital Channels & all business functions).
- Review ITGCs, application controls, access controls, SoD, interface controls, batch jobs & change management.
- Validate secure SDLC/DevSecOps processes: SAST/DAST/SCA, release management, secrets management, and CI/CD controls.
- Perform evidence-based testing, sampling, walkthroughs, and documentation.
- Prepare audit observations, risk ratings, and recommend actionable remediation.
- Handon managing ISO audits and continuous monitoring of ISO controls
2. Technology Risk Management
- Contribute to the Tech Risk Register: identify risks, assess severity, track controls, and monitor treatment plans.
- Participate in risk assessments for new projects, changes, cloud adoption, and third-party onboarding.
- Support creation and review of policies, SOPs, security standards, and control frameworks.
3. Compliance (Insurance Sector)
- Assist in compliance activities aligned to IRDAI Cybersecurity Guidelines, IT Governance Circulars, DPDP obligations, outsourcing guidelines, and business continuity expectations.
- Support regulatory audits, internal audits, and external assessments (ISO, NIST, DR drills).
- Collect evidence and maintain compliance dashboards.
5. Control Monitoring & Reporting
- Support operationalization of Continuous Controls Monitoring (CCM).
- Prepare dashboards on audit status, open issues, compliance KPIs, and control health.
- Work with Infra/App teams to validate closure of findings.
6. Stakeholder Engagement
- Coordinate with Infra, Application, Cloud, DevOps, SOC, Security Engineering, and Business teams.
- Clearly communicate risks, control gaps, and required remediation in a non-technical and business-friendly manner.
7. AI Capabilities
- Ability to use AI tools to analyze large audit datasets, logs, configurations, and evidence for anomalies or control gaps.
- Familiarity with AI‑based pattern detection for identifying control deviations, misconfigurations, and risky behaviors.
- Ability to interpret risk insights generated by AI/ML‑driven security tools (SIEM/SOAR, CSPM, threat intelligence platforms).
- Experience using AI copilots (e.g., Microsoft Copilot, security copilots) to speed up:
Control testing
Log correlation
Report drafting
Evidence summarization
Technical Skills
- IT audits covering Infra & Apps.
- Strong understanding of:
- ISO 27001, NIST CSF, COBIT, CIS benchmarks, OWASP
- Network & cloud security fundamentals
- IAM, PAM, MFA, access certification
- Vulnerability management & patch governance
- SDLC/DevSecOps controls
- Experience in insurance domain processes is mandatory.
Soft Skills
- Strong documentation and audit-report writing.
- Analytical thinking & structured problem solving.
- Ability to collaborate across multiple stakeholders and challenge where necessary.
- Clear communication and the ability to present risks effectively.
Qualifications
Education
- Bachelor’s degree in Engineering/IT/Computer Science or related field.
Certifications (Preferred, not mandatory)
CISA, ISO 27001 Lead Auditor, CRISC, Security+, AWS/Azure Security Fundamentals.