Information Technology Auditor

Emdad By Elm; Riyadh; On-site; SAR 180,000 - 260,000; Full time

Job summary

Emdad By Elm invites an IT & Cyber Audit professional to support the Internal Audit function by assessing IT governance, information security, cyber resilience, and technology-enabled processes across the organization.

You will plan and execute IT and cyber audits, review ITGCs and cybersecurity controls, prepare reports with observations and recommendations, track remediation plans, and advise on control design for new systems and digital initiatives.

Qualifications

• Bachelor's degree in IT, CS, IS, cybersecurity, or related field.
• Relevant IT audit, cybersecurity, risk management, or technology assurance experience.
• Experience in government, regulated environments, or large complex organizations preferred.
• CISA, CISM, CRISC certifications.

Responsibilities

• Plan and execute IT and cybersecurity audits per plan and methodology.
• Assess ITGCs, application controls, and cybersecurity controls across systems, platforms, and infrastructure.
• Evaluate compliance with frameworks (e.g., NCA, ISO 27001, COBIT).
• Prepare audit reports with observations, root causes, risks, and practical recommendations.
• Track management action plans and verify timely closure of audit issues.
• Engage with IT, cybersecurity, and business stakeholders to understand systems, processes, and risk exposures.
• Provide advisory input on control design for new systems and digital initiatives.

Skills

ITGCs

Cybersecurity controls

Cloud platforms

IAM

Data protection

GRC tools

Audit analytics

Stakeholder management

Analytical thinking

Education

Bachelor's degree in IT / CS / IS / Cybersecurity

Tools

GRC tools

Audit analytics

Job description

The IT & Cyber Audit supports the Internal Audit function in providing independent and objective assurance over IT systems, cybersecurity controls, and digital initiatives. The role focuses on assessing the adequacy and effectiveness of IT governance, information security, cyber resilience, and technology-enabled processes to ensure alignment with regulatory requirements, organizational policies, and strategic objectives. The position contributes to strengthening the organization’s control environment, managing technology risks, and enhancing trust in digital services and platforms.

Key Accountabilities

1. IT & Cyber Audit Execution

• Plan and execute IT and cybersecurity audits in accordance with the approved audit plan and internal audit methodology.
• Assess General IT Controls (ITGCs), application controls, and cybersecurity controls across systems, platforms, and infrastructure.
• Evaluate compliance with relevant frameworks and standards (e.g., NCA, ISO 27001, COBIT).

Key Activities

• Conduct IT and cyber audit engagements.
• Review IT governance, security controls, and compliance with applicable frameworks.
• Assess risks and identify control weaknesses.

2. Audit Reporting & Follow-up

• Prepare clear, concise audit reports highlighting observations, root causes, risks, and practical recommendations.
• Track management action plans and validate the timely and effective closure of audit issues.

Key Activities

• Develop audit reports with actionable recommendations.
• Monitor remediation plans and verify issue closure.

3. Stakeholder Management

• Engage with IT, cybersecurity, and business stakeholders to understand systems, processes, and risk exposures.
• Provide advisory input on control design for new systems, digital initiatives, and major IT projects when required.

Key Activities

• Collaborate with key stakeholders throughout audit engagements.
• Support management with advisory services on IT control design.
• Stay updated on emerging technology and cyber risks, regulatory changes, and leading audit practices.
• Contribute to the enhancement of IT audit tools, techniques, and methodologies.

Key Activities

• Monitor industry trends and regulatory developments.
• Enhance audit methodologies and leverage new audit techniques.

Job Requirements

Educational Qualification

• Bachelor's degree in Information Technology, Computer Science, Information Systems, Cybersecurity, or a related field.

Work Experience

• Relevant experience in IT audit, cybersecurity, risk management, or technology assurance.
• Experience within government, regulated environments, or large complex organizations is preferred.

Professional Certifications

• CISA (Certified Information Systems Auditor)
• CISM (Certified Information Security Manager)
• CRISC

Technical Skills

• IT General Controls (ITGCs)
• Cybersecurity controls and frameworks
• Cloud and digital platforms
• Identity and Access Management (IAM)
• Data protection and privacy controls
• GRC tools and audit analytics

Interpersonal Skills

• Strong analytical and critical thinking skills
• Clear written and verbal communication
• Stakeholder management and collaboration
• Attention to detail and professional judgment