experience in ITGC, Client facing role

WNS Holdings; Gurugram District; On-site; INR 800,000 - 1,400,000; Full time

Job summary

WNS Holdings is seeking an IT Controls & Assurance professional to maintain and enhance the IT control environment underpinning financial and operational reporting. You will evaluate ITGC design and operating effectiveness, produce audit-ready documentation, and partner with stakeholders to remediate control gaps.

The role focuses on Identity & Access Management (IAM) with SailPoint, transitioning from manual access recertification to automated governance, reconciling ACLs from Active

Qualifications

• 3-5 years hands-on ITGC/ITAC testing experience in internal/external audit or risk assurance.
• Strong knowledge of SOX/ICFR concepts and their application to control evidence.
• Experience with audit-controlled environments and governance frameworks.

Responsibilities

• Plan and execute walkthroughs and testing over core ITGC domains (logical access, change management, IT operations, disaster recovery).
• Maintain test scripts, evidence, and conclusions per methodology and expectations.
• Identify control deficiencies, classify severity, and define remediation actions with owners.

Skills

ITGC testing

SOX/ICFR concepts

Stakeholder management

Documentation

Analytical thinking

Problem solving

Education

Bachelor’s degree in information systems, Computer Science, Engineering or related discipline

CISA or equivalent professional qualification

Tools

MetricStream

Archer

AuditBoard

ServiceNow GRC

Excel

PowerPoint

SQL

SharePoint/Confluence

Job description

As part of the IT Cyber & Assurance team, you will help maintain and enhance the IT control environment that underpins financial and operational reporting. You will evaluate the design and operating effectiveness of Controls (ITGCs), produce audit ready documentation, and partner with stakeholders to remediate control gaps.

The role has a strong focus on Identity & Access Management (IAM), supporting the clients transition of access certifications and user access governance to SailPoint, with close interaction with Active Directory / Entra ID data.

Role & responsibilities

Control Testing & Evaluation

• Plan and execute walkthroughs and testing (ToD/ToE) over core ITGC domains: Logical access (provisioning, SOD, privileged access, periodic recerts), change management (SDLC, emergency changes), IT operations (backups/restore, batch jobs, monitoring, incident/problem management), and disaster recovery.
• Maintain test scripts, sampling, evidence, and conclusions in line with internal methodology and external expectations.
• Identify control deficiencies, classify severity, and work with owners to define root cause, remediation actions, and target dates.

Governance, Stakeholder & Audit Engagement

• Work with control owners, process leads, Internal audit, External audit and Risk to align scope, gather evidence, and resolve findings.
• Support definition and periodic refresh of the material controls set, mapping to principal risks and financial statement assertions.
• Track and validate remediation; elevate slippage and emerging risks with data backed insights.

Reporting & Documentation

• Produce concise testing reports, issue logs, and management dashboards (e.g., control health, overdue actions).
• Keep the control library, RACMs, narratives and process flow current; ensure evidence is audit ready and retained per policy.
• Log and monitor third party SOC1/SOC2 reports and associated user control considerations impacting ICFR

Identity & Access Management (IAM) - SailPoint

• Support transition from manual access recertification processes to an automated SailPoint based identity governance model, while ensuring ongoing compliance with annual audit.
• Assist with the current manual access review process, which involves:
• Obtaining user access lists (ACLs) directly from applications and directories (e.g., Active Directory / Entra ID),
• Reconciling those populations against SailPoint to validate completeness and accuracy,
• Supporting and executing SailPoint access certification campaigns used as audit evidence.
• Work with IAM, application owners, infrastructure, and security teams to:
• Onboard applications into SailPoint that are not yet integrated,
• Define authoritative access sources, entitlement structures, and certification scope,
• Support the design and testing of automated recertification processes.
• Perform and document reconciliation of SailPoint certification results to application, Active Directory, and Entra ID populations.
• Ensure access recertifications continue to operate effectively during the transition period, including manual or hybrid approaches where automation is not yet available.
• Identify opportunities to reduce manual effort, improve data quality, and strengthen control effectiveness through automation and standardization within SailPoint.

Continuous Improvement

• Contribute to enhancements in control methodology, scoping, and continuous control monitoring.
• Support thematic reviews/deep dives (e.g., joiners/leavers/transfer, emergency changes, backup restorations).
• Champion data driven testing from full population extracts (e.g., Entra ID/AD, SAP, Oracle, Dynamics) to targeted samples.

Preferred candidate profile

• 3 - 5 years hands-on experience in ITGC/ITAC testing within internal audit, external audit, risk assurance, or GRC.
• Strong working knowledge of SOX/ICFR concepts and how they translate into UK Governance Code Provision 29 evidence expectations (material controls, effectiveness at balance-sheet date).
• Familiarity with control frameworks such as SOX, COBIT and ISO 27001; understanding of COSO principles and their mapping to IT controls.
• Experience supporting Identity & Access Management (IAM) initiatives, including SailPoint access certifications, reconciliation of certification populations to Active Directory / Entra ID and application access, and assisting with application onboarding and automation of access reviews in an audit-controlled environment.
• Excellent documentation, analytical and problem-solving skills; able to articulate clear, defensible conclusions.
• Proven stakeholder management; comfortable with challenging conversations and influencing outcomes.
• Proficiency with Excel and PowerPoint; experience with control monitoring/GRC tools (e.g., MetricStream, Archer, AuditBoard, ServiceNow GRC).
• Ability to work independently, handle multiple priorities, and meet deadlines in a fast-moving environment.

Education & Qualifications:

Bachelors degree in information systems, Computer Science, Engineering or a related discipline.

CISA (or actively pursuing) or equivalent professional qualification.

Good to have, not mandatory:

• Certifications such as COBIT Foundation, ISO/IEC 27001 LA/LI, ITIL, CCSK.
• Additional audit/risk credentials (e.g., CIA, CRISC).

Tools you may use

• GRC/ICFR: MetricStream (or equivalent), SharePoint/Confluence, Jira/ServiceNow.
• Data & Evidence: Excel/Power BI, SQL, ERP audit logs (SAP GRC, Oracle, Dynamics), Entra ID/AD.