Manager- Technology Risk & Control- IT Audit

Grant Thornton Bharat LLP; Bengaluru; Presencial; INR 2.500.000 - 4.200.000; Jornada completa

Descripción de la vacante

Grant Thornton Bharat LLP in Bengaluru seeks an experienced Technology Risk & Controls, IT Audit professional with 7–10 years of hands-on audit and risk experience. The role focuses on ITGCs, application and cloud audits, and ongoing assurance across enterprise tech environments.

Ideal candidates have GCC or multinational exposure, strong stakeholder skills, and a practical grasp of AI and GenAI in audit processes. This on-site role emphasizes governance and risk control improvements.

Formación

• 7–10 years of relevant experience in Technology Risk, IT Audit or Internal Audit.
• Experience in GCC/large multinational environments is preferred.
• Hands-on audit experience across ITGC, applications, infrastructure and cloud.
• Knowledge of AI/GenAI and its audit implications is a plus.

Responsabilidades

• Lead and execute risk-based IT and technology audits across enterprise environments.
• Perform technology risk assessments, identify key risks and control gaps.
• Assess ITGCs including access management, change control and IT operations.
• Develop audit programs, RCMS, testing approaches and working papers.
• Draft observations, assess risks and recommend remediation measures.
• Track audit issues with stakeholders to achieve timely closure.
• Conduct enterprise technology risk assessments and maintain risk registers.
• Perform application security, configuration and data integrity audits.
• Evaluate cloud governance, IAM, data protection and resilience controls.
• Apply GenAI prompts for audit planning, evidence review and reporting.

Conocimientos

Technology risk

IT audit

Cybersecurity audit

ITGC

Risk assessment

Stakeholder management

Documentation

Report writing

GenAI awareness

Cloud risk & controls

Educación

Bachelor’s or Master’s degree in Technology/Engineering/CS/IS

CISA

CISSP / CISM / CRISC

CIA / ISO27001 certification

Azure/AWS/GCP cloud security certs

Herramientas

Azure

AWS

GCP

Descripción del empleo

Experience: 7–10 years

Preferred Background: Global Capability Center (GCC) / large multinational environment / IT Firm/ Banks and NBFCs

Role Overview

We are seeking an experienced Technology Risk & Controls, IT Audit professional with 7–10 years of relevant experience, preferably gained within a Global Capability Center (GCC) or large multinational organization.

The role will be responsible for executing and leading technology risk assessments, IT and security audits, IT controls reviews and assurance activities across applications, infrastructure, cloud and emerging technologies. The individual will work with technology, cybersecurity, risk, internal audit and business stakeholders to identify technology risks, assess control effectiveness and drive improvements to the overall technology control environment.

The ideal candidate will combine strong hands-on audit and controls expertise with knowledge of modern technology environments and emerging capabilities such as AI and Generative AI.

Key Responsibilities

IT Audit & Technology Risk

• Lead and execute risk-based IT and technology audits across enterprise technology environments.
• Perform technology risk assessments and identify key risks, control gaps and improvement opportunities.
• Assess IT General Controls (ITGCs) including user access management, privileged access, change management and IT operations.
• Evaluate the design and operating effectiveness of technology controls.
• Develop audit programs, Risk and Control Matrices (RCMs), testing approaches and working papers.
• Draft clear audit observations, assess associated risks and recommend practical remediation measures.
• Track audit issues and work with stakeholders toward timely remediation and closure.

Enterprise Technology Risk Assessment

• Perform enterprise-level technology and cyber risk assessments.
• Identify inherent risks, evaluate existing controls and assess residual risk.
• Support Risk and Control Self-Assessments (RCSAs) and technology control assessments.
• Develop and maintain risk registers and RCMs.
• Work with stakeholders to identify and establish appropriate remediation plans for material control gaps.

Application & Integrated Audits

• Perform application audits covering application security, access, configuration, change management, interfaces, data integrity and automated controls.
• Assess application-level controls and technology-dependent business controls.
• Participate in integrated audits alongside business, operational, financial and compliance audit teams.
• Understand end-to-end business processes and identify critical technology dependencies and associated control risks.
• Conduct technology audits across servers, operating systems, databases, networks, data centers and related infrastructure.
• Review access security, configuration management, patching, vulnerability management, monitoring, backup and recovery.
• Assess Disaster Recovery, Business Continuity and technology resilience controls.
• Evaluate infrastructure risks associated with legacy technology and modernization programs.
• Conduct cloud readiness, cloud risk and control assessments.
• Evaluate cloud governance, security architecture, IAM, data protection, logging, monitoring, resilience and workload security.
• Assess technology risks associated with cloud migration and transformation programs.
• Exposure to Microsoft Azure, AWS and/or Google Cloud environments is preferred.

AI & Generative AI Capability

Given the increasing adoption of AI across risk and assurance functions, the candidate should have working knowledge of AI and Generative AI, including:

• Ability to write effective, structured prompts for Generative AI tools.
• Use AI to support audit planning, risk identification, control mapping and document analysis.
• Apply GenAI for first-pass analysis of policies, procedures, audit evidence and control documentation.
• Use AI for development and review of RCMs, testing procedures, audit observations and management reports.
• Understand the key risks associated with AI, including data confidentiality, security, privacy, governance, model risk and responsible AI.
• Demonstrate awareness of appropriate human review and validation when using AI-generated outputs in audit and assurance activities.

Required Experience & Skills

The candidate should have:

• 7–10 years of relevant professional experience in Technology Risk, IT Audit, Cybersecurity Audit, IT Controls and/or Internal Audit.
• Preferably experience within a GCC / Global Capability Center or large multinational organization.
• Hands-on experience performing and/or leading technology audits and risk assessments.
• Strong experience across several of the following:
• IT Audit
• ITGC
• Cybersecurity Audit
• Internal Audit
• Application Audit
• Infrastructure Audit
• Integrated Audit
• Strong understanding of control design and operating effectiveness testing.
• Ability to translate technical vulnerabilities or control deficiencies into clearly articulated business and technology risks.
• Strong stakeholder-management, documentation, PPT and report-writing skills.
• Ability to work effectively with global stakeholders across technology, cybersecurity, audit and risk functions.

Preferred Framework Knowledge

Experience with one or more of the following is desirable:

• COBIT
• NIST Cybersecurity Framework
• ISO/IEC 27001
• COSO
• ITIL
• CIS Controls
• SOX / ITGC
• SOC 1 / SOC 2
• Cloud security and controls frameworks

Preferred Qualifications / Certifications

Bachelor’s or Master’s degree in Technology, Engineering, Computer Science, Information Systems, Cybersecurity, Finance or a related discipline.

One or more of the following certifications would be preferred:

• CISA
• CISSP
• CISM
• CRISC
• CIA
• ISO 27001 certification
• Relevant Azure, AWS or GCP security/cloud certification

Candidate Profile

The ideal candidate is a hands-on technology risk professional rather than a purely supervisory auditor. They should be comfortable moving between detailed control testing and discussions with senior technology and risk stakeholders.

Experience in a GCC environment is particularly relevant where the individual has worked with global technology platforms, geographically distributed stakeholders, centralized control environments and global audit/risk teams.

They should also demonstrate curiosity around AI and GenAI, with the ability to use prompt engineering and AI-assisted techniques thoughtfully within the audit and risk lifecycle.