Associate Auditor-Immediate Joiner

Reserve Bank Information Technology; Navi Mumbai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Reserve Bank Information Technology invites seasoned information security professionals to join our audit team in Mumbai. The role focuses on information security operations, IS audits, and risk assessments across banking tech domains such as application, database, and payments systems.

You will conduct policy reviews, threat assessments, and prepare high-quality reports and presentations. Extensive travel for RBI audits nationwide is required, with emphasis on ISO standards, PCI-DSS, and ITGC

Qualifications

• 1 - 5 years of experience in information security operations and audits.
• Exposure to Banking/Finance/Payment domains preferred.
• Experience writing information security policies and risk assessments.
• Experience in ISO standards and regulatory guidelines in banking sector.

Responsibilities

• Conduct audits of information security policies, procedures, and processes.
• Perform audits across Active Directory, WAF, Network access, endpoint security, PCI-DSS, ATM controls.
• Prepare audit reports and presentations with clear findings and recommendations.
• Travel extensively within Mumbai and across the country for RBI audits.

Skills

Information security operations

Information System Audits

Banking technologies domains

Application Security

Database Security

Payments systems security

Networks security

IT General Controls

ISO standards & regulatory guidelines

PCI DSS

Tools

Oracle

MS SQL

Job description

• 1 - 5 years of experience in the field of information security operations, Information System Audits encompassing experience into any of the Banking Technologies Domains Application Security, Database management and administration, / Network security and SOC / Payment systems in addition to IT General controls (ITGC).
• Exposure to the Banking / Finance / Payment industry domains would be preferrable.
• Hands-on experience in the following areas:
• Writing Information security policies, procedures, and processes
• Conducting risk assessment covering Cyber Security domains as noted below:

Application Security:

• Mobile application assessment, OWASP security practices for applications, VA/PT/AppSec, source-code review, black/grey/white box testing, application SDLC, Strong knowledge of programming languages for applications.

Database Security:

• Database administration and management - Oracle, MS SQL etc., Database Activity Monitoring tools, data security and localization.

Payments Systems Security:

• Understand payment systems and architecture such as SWIFT, UPI, IMPS, ATM, Internet Banking, Mobile Banking, Core Banking System, payment gateway, ATM switch and terminal.
• Experience in PCI DSS implementation/assessment and ATM end-point security and Cards data security and operations.

Networks Security:

• Managing firewalls, routers, proxy, WAF, email filtering, DLP, DDoS protection, data encryption, IPS/IDS, Incident response and investigate security breaches, VA-PT for networks.
• Security Operations Centre- Implementation and review.

IT General Controls:

• Familiarity with Technical Security controls of Identity & Access Management, Network, Server, Application, Change management, Backup and Restoration etc. and process controls reviews.
• Understand BCP and DR processes and architecture.
• Experience in conducting reviews based on ISO standards and regulatory guidelines in banking sector for a medium to large sized organization would be preferred.
• Experience in conducting Information System Audits
• Must have experience in preparing quality deliverables such as audit reports, presentations etc.
• Excellent written, oral communication and presentation skills
• Excellent organizational and interpersonal skills
• Ability to work independently or as part of a team

Please note : While multi domain expertise and certifications are preferred, the candidate is required to have specialization in at least one of the technical areas mentioned above.

Information technology / Banking and Financial services / Auditing / Cyber Security consulting

• Candidate will have to travel extensively within Mumbai and across the country for performing audits, as per RBI requirements.
• Conducting audit of Information security policies, procedures, and processes to identify process/design gaps.
• Conduct audits of information security systems and infrastructure to verify systems are secure and support the related applications/business processes.
• Conducts audits in different banking technology domains such as Active Directory, WAF, Network access security, End-point security, Application VA/PT/AppSec, SDLC, Database management and security, PCI-DSS, ATM controls, Cards (Debit/Credit) security, Payment-gateway and IT General Controls etc.
• Additional weightage will be given to candidates with experience in domains such as Cloud Security, API security.
• Developing project plans, work programs, evaluating system controls, identify risks and audit gaps, documenting results in proper audit report format, making recommendations, and communicating information to stakeholders.
• Support in maintaining audit checklist and documents, trend analysis, preparing presentations etc.
• Should be a self-learner and must keep updated with the latest security guidelines issued by regulators, international standards for information security, threats and vulnerabilities researched/discovered.
• Research public domain to keep up to date knowledge on latest banking applications / technologies and emerging technologies Cloud, Virtualisation, AI-ML, IOT etc. and ensure continuous learning in identified security competencies and new/emerging technologies.