IT Audit Lead

Paytm Payment Gateway; Dadri; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

A financial technology company located in India is seeking an experienced Information Security and Cloud Security Auditor. The role requires at least 10 years of experience in information security, focusing on IT and cloud security audits, regulatory compliance, and enhancing security policies. Ideal candidates should have expertise in vulnerability management, risk management, and third-party risk assessments. The company values strong analytical skills and offers a dynamic work environment.

Qualifications

• 10+ years of experience in information security and auditing, especially in cloud security.
• Hands-on experience with cybersecurity frameworks and standards like PCI-DSS and ISO 27001.
• Expertise in ITGC and cloud application controls.

Responsibilities

• Conduct IT and cloud security audits across various domains.
• Develop and enhance security policies and procedures.
• Manage third-party risk assessments and audits.

Skills

Information security auditing

Cloud security

Risk management

Third-party risk management

Cybersecurity governance

Vulnerability management

Excellent communication

Analytical skills

Education

Bachelor's / Master’s degree in Information Technology or Cyber Security

Tools

AWS

Azure

Google Cloud Platform

Palo Alto

Fortinet

Checkpoint Firewalls

Job description

About Team

The Internal Audit team at Paytm comprises seasoned professionals with diverse skill sets and experience across different verticals like process audits, technology audits, and forensics. The team focuses on implementing the approved audit plan, ensuring delivery of qualitative audits and conducting internal/special reviews while leveraging technology & data analytics and gauging key risks across business processes.

About the Role

We are seeking an experienced and detail-oriented Information Security and Cloud Security Auditor to join our team. The ideal candidate will have 3-7 years of expertise in data security and privacy control implementation, internal auditing, third-party risk management, cybersecurity governance, and cloud security (banking sector preferred). This role will be responsible for conducting comprehensive IT and cloud security audits, ensuring compliance with regulatory requirements, and enhancing our information security policies and procedures.

Key Responsibilities

• Conduct IT and cloud security audits across various domains, including IT General Controls, Information Security Controls, Cloud Security, Network Security, Vulnerability Management, and Vendor Risk Assessments.
• Assess compliance with relevant laws, regulations, and organizational policies, providing expertise in regulatory requirements specific to both on-premises and cloud environments.
• Develop and enhance information security and cloud security policies and procedures in alignment with industry best practices.
• Maintain thorough documentation of audit findings, risk assessments, and security measures for internal and external reporting.
• Validate ITGC, cloud security, and application-specific controls, and manage audit documentation including risk assessments, working papers, audit program checklists, and evidence gathering.
• Follow up on and ensure closure of non-compliance issues identified during audits.
• Manage and oversee third-party risk assessments and audits, ensuring robust security controls are in place for both traditional and cloud-based service providers.
• Lead and participate in the development, migration, and implementation of security controls and policies for network and cloud security solutions.
• Conduct risk-based security assessments on internal, vendor, and third-party hosted environments, focusing on both traditional IT and cloud infrastructure.
• Participate in product and vendor selection processes, contributing to the implementation and integration of new technologies, with a strong emphasis on cloud security solutions.

Experience & Skills Required

• Minimum 10 years of experience in information security and auditing, with a strong background in cloud security, and the banking and IT industries.
• Proven experience in performing IT and cloud security audits, validating ITGC and cloud application controls, and maintaining audit documentation.
• Hands‑on experience with vulnerability management, risk management, physical security, identity & access management, encryption, secure development, incident management, security infrastructure, and security policy for both on-premises and cloud environments.
• Expertise in third‑party risk management, regulatory compliance, and managing IT audit findings in both traditional and cloud‑based contexts.
• Strong analytical and problem‑solving skills.
• Excellent communication and documentation skills.
• Ability to manage multiple projects and meet deadlines.
• Strong understanding of IT, cloud security, and cybersecurity frameworks and standards.
• Proficiency in using various security assessment tools and technologies, particularly those related to cloud environments.
• Proficiency in various security and cloud technologies including AWS, Azure, Google Cloud Platform, Palo Alto, Fortinet & Checkpoint Firewalls, SOAR (Cortex), Force Scout.

Qualifications & Certification

• Bachelor's / Master’s degree in Information Technology, Cyber Security, or a related field.
• ISO 27001/CNSS/CCNA/CISA/CISM/CISSP Preferred.
• Detailed knowledge of security tools, PCI-DSS, general ITGC controls, compliance testing, cloud risk assessment, GRC, OWASP, MITRE ATT&CK, change management, and policies and procedures.