Lead IT Auditor

Private Advertiser; Mandaluyong; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

Private Advertiser in Metro Manila is seeking an experienced IT Auditor to join the Internal Audit function. The role will provide independent assurance over the organization’s technology environment, cybersecurity controls, data governance, cloud infrastructure, digital banking platforms, and overall technology risk management framework.

This is a hands-on, risk-based audit role suited for an IT audit professional who can operate confidently within a modern, cloud-based and API-driven

Qualifications

• 6–10 years of IT audit, information security, technology risk, or related discipline, preferably in banking/fintech.
• Experience auditing cloud-based technology environments (AWS, Azure, GCP), including IAM and security configurations.
• Strong working knowledge of BSP technology and IT risk regulations and their practical application in a regulated financial institution.
• Experience assessing information security and cybersecurity controls, including vulnerability management and incident response.
• Understanding of core banking architecture, APIs, digital banking platforms, and transaction-processing environments.
• Familiarity with data governance, data privacy, data integrity, and technology-enabled regulatory reporting.

Responsibilities

• Plan and execute risk-based IT audit engagements covering cloud infrastructure, core banking platforms, digital channels, APIs, payment systems, applications, and data environments.
• Assess the design and operating effectiveness of IT and cybersecurity controls, including access management, security monitoring, vulnerability management, incident response, and technology resilience.
• Evaluate digital customer onboarding and eKYC processes, including identity verification controls, data security, transaction integrity, and AML compliance.
• Review IT change management, release management, patch management, and SDLC controls to ensure changes are properly authorized, tested, documented, and deployed.
• Assess cloud governance and security controls, including IAM, encryption, logging and monitoring, configuration management, data protection, data residency, and third-party cloud obligations.
• Conduct data governance and data integrity audits, evaluating accuracy, completeness, confidentiality, and security of customer, financial, operational, and regulatory data.
• Review third-party technology and vendor risk management, including security requirements, contractual obligations, due diligence, and monitoring.
• Evaluate business continuity and disaster recovery arrangements, including RTOs, DR testing results, and data backup controls.
• Audit payment and transaction-processing controls, including settlement, reconciliation, and exception handling.
• Assess AI and model governance controls from audit/risk perspective.
• Prepare concise, evidence-based IT audit reports for senior management and Board.
• Monitor timely remediation of audit findings and escalate overdue/high-risk issues.
• Maintain awareness of emerging technology, cybersecurity, regulatory, and digital banking risks.

Skills

IT audit experience

Cloud-based environments

IT risk regulations

Information security controls

AWS

Azure

GCP

Data governance

Audit report writing

CISA certification

Payment systems

Tools

AWS

Azure

GCP

Job description

About the Role

We are seeking an experienced IT Auditor to join the Internal Audit function of a growing digital financial institution. The role will provide independent assurance over the organization’s technology environment, cybersecurity controls, data governance, cloud infrastructure, digital banking platforms, and overall technology risk management framework.

This is a hands-on, risk-based audit role suited for an IT audit professional who can operate confidently within a modern, cloud-based and API-driven technology environment. The successful candidate will work closely with technology, information security, risk, and business teams while providing objective insights to senior management and the Board Audit Committee.

Key Responsibilities

• Plan and execute risk-based IT audit engagements covering cloud infrastructure, core banking platforms, digital channels, APIs, payment systems, applications, and data environments.

• Assess the design and operating effectiveness of IT and cybersecurity controls, including access management, security monitoring, vulnerability management, incident response, and technology resilience.

• Evaluate digital customer onboarding and eKYC processes, including identity verification controls, data security, transaction integrity, and compliance with applicable regulatory and AML requirements.

• Review IT change management, release management, patch management, and SDLC controls to ensure technology changes are properly authorized, tested, documented, and deployed.

• Assess cloud governance and security controls, including IAM, encryption, logging and monitoring, configuration management, data protection, data residency, and third-party cloud obligations.

• Conduct data governance and data integrity audits, evaluating the accuracy, completeness, confidentiality, and security of customer, financial, operational, and regulatory data.

• Review third-party technology and vendor risk management, including security requirements, contractual obligations, due diligence, service monitoring, and controls surrounding critical technology providers.

• Evaluate business continuity and disaster recovery arrangements, including recovery objectives, system resilience, backup controls, DR documentation, and results of recovery testing.

• Audit payment and transaction-processing controls, including transaction integrity, settlement and reconciliation, exception handling, dispute management, and relevant domestic payment channels.

• Assess AI and model governance controls from an audit and risk perspective, including model validation, monitoring, change management, documentation, governance, and auditability of technology-enabled decision-making.

• Prepare clear, concise, and evidence-based IT audit reports, translating technical observations into business and risk implications for senior management and the Board Audit Committee.

• Monitor and validate the timely and effective remediation of audit findings, escalating overdue or high-risk issues where appropriate.

• Maintain awareness of emerging technology, cybersecurity, regulatory, and digital banking risks, and assess their potential impact on the organization’s control environment.

What We’re Looking For

• 6–10 years of experience in IT audit, information security, technology risk, or a related discipline, preferably within banking, financial services, fintech, or another highly regulated environment.

• Experience auditing cloud-based technology environments such as AWS, Azure, or GCP, including IAM, security configurations, logging and monitoring, and cloud governance.

• Strong working knowledge of BSP technology and IT risk regulations, cybersecurity requirements, and their practical application within a regulated financial institution.

• Experience assessing information security and cybersecurity controls, including vulnerability management, penetration testing, endpoint security, network security, and incident response.

• Understanding of core banking architecture, APIs, digital banking platforms, and transaction-processing environments, with the ability to trace processes and identify technology and control risks.

• Familiarity with data governance, data privacy, data integrity, and technology-enabled regulatory reporting.

• Exposure to AI or model governance from an audit, risk, controls, or assurance perspective is an advantage.

• Experience auditing payment systems and financial transaction environments is highly desirable.

• Strong analytical, communication, and audit report-writing skills, with the ability to present technical findings clearly to both technical and non-technical stakeholders.

• CISA certification is required. Additional certifications such as CISSP, CCSP, CIA, or relevant cloud/security certifications are an advantage.

• Strong understanding of risk-based internal audit methodologies, control frameworks, and technology risk principles.

Why This Role

This role provides an opportunity to help strengthen the technology control environment of a modern digital financial institution. You will gain broad exposure across cloud technology, cybersecurity, digital banking, payments, data governance, AI-enabled processes, and technology risk, while working closely with senior management and the Board Audit Committee.

The position is ideal for an IT audit professional looking to move beyond traditional, legacy-focused environments and take on a broader technology assurance role within a rapidly evolving digital organization.