Senior Assistant Director, Group Internal Audit

Job Summary

The Senior Assistant Director, IT and Cybersecurity Audit role will be pivotal in leading and executing audit assignments relating to IT infrastructure, cybersecurity, digital transformation, data governance, and technology risk management across the FPL Group.

You will be part of the core team of Group Internal Audit.  As a trusted advisor, you will play a key role in evaluating the adequacy and effectiveness of internal controls, identifying risks, and providing practical recommendations to enhance our cybersecurity posture and technology governance.  This covers end to end IT and cybersecurity audits, tracking resolution of audit issues and implementation of audit recommendations, validating control effectiveness post remediation and continuous monitoring of the IT landscape.

You will also support continuous improvement in the effectiveness and efficiency of the Group Internal Audit’s core activities and provide IT support and expertise to the business / operations audit teams.  Overall, you will work closely with stakeholders at all seniority levels across IT, risk, compliance, and business units.

Job Description

•    Perform independent risk assessment on IT infrastructure and applications to formulate the Annual IT Audit Plan in accordance with internal audit standards and frameworks.

•    Plan, execute and manage risk-based IT audit projects in accordance with the approved Annual IT Audit Plan.

•    Establish and update audit review procedures and test steps for each audit project, ensuring adequate, effective and efficient coverage of the review of IT general controls, application controls, and cybersecurity frameworks. 

•    Evaluate emerging technology risks in areas such as cloud computing, artificial intelligence, digital transformation, data privacy, and third-party IT risk.  

•    Propose and initiate special or targeted review projects from time to time to cover review of system implementation, applications and other IT-related risk areas in a timely manner.

•    Interpret IT and cybersecurity vulnerabilities and provide practical recommendations with reference to industry security best practices.  Proactively follow up on risk events, IT incidents, and external audit and regulatory issues observed during the audit or through regular cadence with management teams.

•    Drive remediation tracking and closure of audit findings and implementation of audit recommendations by management teams in a timely manner, including those findings and recommendations raised by the external auditors, where relevant.

•    Establish and maintain collaborative working relationships with Group and Business Unit management teams to build credibility and promote a culture of risk and control frameworks awareness.

•    Serve as the in-house subject matter expert on IT and cybersecurity risks with the Group Internal Audit function, supporting its automation and digitalization initiatives and development or learning needs of its staff members. 

•    Stay abreast of IT risk landscape, regulatory developments, emerging cyberthreats, and best practices in IT governance. 

Key Qualification

•    Degree in Computer Science, Information Systems, Cybersecurity, or related field from a reputable education institute.

•    Professional certifications such as CISA, CISSP, CRISC, CISM, or equivalent are highly preferred.

•    Minimum 10 years of experience in IT and cybersecurity audit in an MNC or global professional consultancy environment, with at least 2 years in a managerial capacity.

•    Proficient in IT infrastructure security and cybersecurity and processes, covering network devices, system (SAP or equivalent ERP systems) and database platforms.  This include management of third-party IT vendors and cloud service providers.

•    Technical knowledge of information and operations technology and processes.  This covers IT and data governance, authentication and authorization controls, user requirements understanding, application release functionalities validation, security and control design assessment.

•    Technical knowledge of IT project management.  This includes planning and approval of IT projects, quality controls, user acceptance testing procedures, data conversion and migration, and training and cutover procedures.

•    Competent in IT audit methodologies and IT control frameworks, including industry best practices (such as GTAG, NIST, COBIT, COSO, ISO27001).

•    Good knowledge of technology risk management guidelines and cyber-related regulations including relevant compliance requirements.

•    Strong communication (verbal and written) and interpersonal skills.  Able to work with all levels of management, to inspire, influence and negotiate at a senior level.

•    Strong project management and organization skills.  Able to navigate through ambiguity, manage and coordinate multiple audit projects simultaneously in a fast-paced, deadline-driven environment, accepting ownership and accountability of the process and deliver on commitments.