Data Governance & Controls Assurance Consultant

Employment; Doha; On-site; QAR 150,000 - 230,000; Full time

Job summary

Employment in Doha seeks a Data Governance & Controls Assurance Consultant to provide advisory services over client data governance, security, controls and evidence. The consultant will assess policies, processes and evidence, ensuring independence and enabling strong governance.

The role engages governance, data, security, risk and audit stakeholders to deliver actionable recommendations. The position emphasizes risk-based scope and evidence-led testing, with experience in data platforms,

Qualifications

• Bachelor's degree requirement; equivalent experience considered.
• 4–8 years in internal audit, technology audit, risk or assurance.
• Experience with data governance, controls assurance, risk or compliance.

Responsibilities

• Define risk-based assurance scope, objectives, criteria, evidence needs and reporting protocols.
• Review governance frameworks, policies, standards and evidence.
• Assess control design and operating evidence across data quality, metadata, sharing, security, retention, platforms and analytics.
• Conduct interviews, walkthroughs, document reviews and evidence validation.
• Document findings with condition, criteria, cause, consequence, risk and practical recommendations.
• Validate management responses, owners, target dates, dependencies and closure evidence.
• Track remediation and perform follow-up testing before closure discussions.
• Escalate matters requiring formal audit, legal, regulatory or executive attention.

Skills

Risk-based auditing

Control testing

Evidence evaluation

Report writing

Data risk

Independence

Scepticism

Interviewing

Findings writing

Remediation support

Education

Bachelor's degree in audit, accounting, information systems, cybersecurity

Job description

Data Governance & Controls Assurance Consultant

Role Purpose The Data Governance & Controls Assurance Consultant provides advisory and independent-assurance services over client data governance, security, controls and implementation evidence. The role evaluates whether policies, accountabilities, processes and controls are appropriately designed, implemented and supported by evidence, and whether identified issues are being remediated effectively. The consultant uses a risk-based and evidence-led approach, working with governance, data, security, technology, risk and audit stakeholders. It reports factual findings, root causes, implications and practical recommendations while preserving independence and confidentiality. The role does not own the controls being assessed, approve client risk or act as the client's internal auditor unless that responsibility is formally contracted and independence safeguards are established. The expected outcome is clear assurance that helps client leaders strengthen governance and control effectiveness.

Key Responsibilities

Define risk-based assurance scope, objectives, criteria, evidence needs, sampling approach and reporting protocols. Review governance frameworks, policies, standards, RACI matrices, committee evidence, registers and performance reporting. Assess control design and operating evidence across data quality, metadata, sharing, security, retention, platforms and analytics. Conduct interviews, walkthroughs, document reviews, sample testing and evidence validation. Distinguish control design gaps, implementation gaps, evidence gaps and isolated exceptions. Document findings with condition, criteria, cause, consequence, risk and practical recommendation. Validate management responses, owners, target dates, dependencies and planned closure evidence. Track remediation and perform follow-up testing before recommending closure. Identify systemic themes, control dependencies and recurring weaknesses across domains or entities. Prepare concise assurance reports and facilitate factual-clearance discussions with stakeholders. Maintain independence, confidentiality, working papers, evidence traceability and quality review. Escalate matters requiring formal audit, legal, regulatory or executive attention through authorised channels.

Minimum Requirements

Education Bachelor's degree in audit, accounting, information systems, cybersecurity or a related field. An equivalent combination of relevant education and directly applicable consulting or implementation experience may be considered.

Professional Experience

Typically 4-8 years in internal audit, technology audit, risk or assurance. Experience in internal audit, technology audit, data governance, controls assurance, risk or compliance. Experience evaluating design and operating effectiveness and retaining defensible working papers. Experience writing findings and facilitating factual-clearance and remediation discussions. Exposure to data platforms, governance frameworks, information security or regulated environments is preferred.

Technical and Domain Knowledge

Risk-based assurance and control assessment methods. Data-governance, policy, accountability and committee controls. Technology, data-quality, metadata, sharing and security-control concepts. Evidence sampling, walkthroughs, testing and working-paper standards. Finding development, root-cause analysis and risk articulation. Remediation planning, follow-up testing and closure evidence. Independence, confidentiality and conflict-of-interest safeguards. Executive assurance reporting and thematic analysis.

Core Competencies

Risk-based auditing. Control testing. Evidence evaluation. Report writing. Technology and data risk. Professional independence. Professional scepticism. Evidence judgement. Integrity. Conducting structured interviews and evidence-based challenge. Writing precise, balanced and defensible findings. Facilitating factual-clearance without diluting valid issues. Maintaining independence while supporting practical remediation. Communicating control risk to technical and executive audiences. Managing sensitive information and complete working papers. Recognising when specialist legal, security or audit escalation is required.

Preferred Certifications

Certified Internal Auditor (CIA) CISA preferred for technology-focused roles

Focus areas

Risk-based auditing Control testing Evidence evaluation