Assistant Manager, Group Internal Audit

Job Summary

The Assistant Manager, IT & Cybersecurity Audit supports IT audits within FPL Group Internal Audit, focusing on IT and cybersecurity reviews, issue resolution, and control validation. Responsibilities include assessing IT infrastructure, systems, and applications, enhancing audit efficiency, and providing IT expertise for business and operational audits. The role may occasionally involve general audit assignments.

Job Description

• Support the planning, execution and reporting of risk-based IT audit projects in accordance with the approved Annual IT Audit Plan.  In addition to the planned projects, special or targeted review projects may be initiated from time to time to cover review of system implementation, applications, and other IT-related risk areas in a timely manner.
• Interpret IT and cybersecurity vulnerabilities and provide recommendations according to industry security best practices.  Assist in the follow up on risk events, IT incidents, and external audit and regulatory issues observed during the audit.
• Track and monitor IT-related audit findings raised by Group Internal Audit and the external auditors, where relevant, to ensure they are addressed satisfactorily by management teams in a timely manner.
• Support development of continuous auditing initiatives using Data Analytics tool within Group Internal Audit and share IT and cybersecurity knowledge across the staff members.
• Undertake continuous learning and development programs proactively to keep abreast of changes in IT risk landscape, regulatory requirements, and industry standards / best practices.

Key Qualification

• Degree in Computer Science, Information Systems or equivalent from a reputable education institute, with professional certification such as CISA, CISSP, CISM, etc.  Candidates who do not possess the stipulated qualifications but have relevant professional certification and work experience may still apply.
• Minimum 5 years of experience in IT and cybersecurity audit in an MNC or professional consultancy environment.
• Competent in IT audit methodologies and concepts (such as GTAG, COBIT and COSO), including industry best practices.
• Knowledge of IT infrastructure and cybersecurity processes, covering cloud infrastructure, network devices, and application system platforms.  This includes management of third-party IT vendors and cloud service providers.
• Knowledge of information and operational technology and processes.  This covers IT and data governance, authentication and authorization controls, user requirements understanding, application release functionalities validation, security, and control design assessment.
• Knowledge of IT project management, inclusive of waterfall and agile methodology.  This includes planning and approval of IT projects, quality controls, user acceptance testing procedures, data conversion and migration, and training and cutover procedures.
• Knowledge of technology risk management guidelines and cyber-related regulations including relevant compliance requirements.
• Good critical thinking and proactive in making sure the project is completed in time.
• Good communication (verbal and written) and interpersonal skills.  Able to work with all levels of management.
• Good project management and organization skills.  Willing to work in a fast-paced, deadline-driven environment, accept ownership and accountability of the process, and deliver on commitments.
• Willingness to participate in general or operations audits (non-IT audits) including investigative reviews from time to time, as assigned.