IT Audit

Emdad By Elm; Riyadh; On-site; SAR 180,000 - 240,000; Full time

Job summary

Emdad By Elm is seeking an IT & Cyber Audit professional to support the Internal Audit function. The role focuses on assessing IT governance, information security, cyber resilience, and technology-enabled processes to ensure alignment with regulatory requirements and organizational policies.

The position involves planning and executing IT and cybersecurity audits, evaluating ITGCs and application controls, and delivering actionable audit reports with root causes and recommendations.

Qualifications

• Experience in IT governance and information security controls.
• Familiarity with cyber risk assessment and audit methodologies.
• Understanding of COBIT, ISO 27001, and NCA regulatory requirements.

Responsibilities

• IT & Cyber Audit Execution: plan and conduct audits per the approved audit plan.
• Assess IT general controls (ITGCs), application controls, and cyber security controls.
• Evaluate compliance with frameworks (COBIT, ISO 27001, NCA).
• Prepare concise audit reports with observations, root causes, risks, and recommendations.
• Track management action plans and verify timely closure of audit issues.
• Engage stakeholders to understand systems, processes and risk exposures.

Job description

Role Purpose

The IT & Cyber Audit supports the Internal Audit function in providing independent and objective assurance over IT systems, cybersecurity controls, and digital initiatives. The role focuses on assessing the adequacy and effectiveness of IT governance, information security, cyber resilience, and technology-enabled processes to ensure alignment with regulatory requirements, organizational policies, and strategic objectives. The position contributes to strengthening the organization’s control environment, managing technology risks, and enhancing trust in digital services and platforms.

Key Accountabilities

• IT & Cyber Audit Execution


• Plan and execute IT and cybersecurity audits in accordance with the approved audit plan and internal audit methodology.


• Assess General IT Controls (ITGCs), application controls, and cybersecurity controls across systems, platforms, and infrastructure.


• Evaluate compliance with relevant frameworks and standards (e.g., NCA, ISO 27001, COBIT).

Key Activities

• Conduct IT and cyber audit engagements.


• Review IT governance, security controls, and compliance with applicable frameworks.


• Assess risks and identify control weaknesses.


• Audit Reporting & Follow-up


• Prepare clear, concise audit reports highlighting observations, root causes, risks, and practical recommendations.


• Track management action plans and validate the timely and effective closure of audit issues.


• Develop audit reports with actionable recommendations.


• Monitor remediation plans and verify issue closure.


• Stakeholder Management


• Engage with IT, cybersecurity, and business stakeholders to understand systems, processes, and risk exposures.


• Provide advisory input on control design for new systems, digital initiatives, and major IT projects when required.


• Collaborate with key stakeholders throughout audit engagements.


• Support management with advisory services on IT control design.


• Continuous Improvement & Knowledge Development


• Stay updated on emerging technology and cyber risks, regulatory changes, and leading audit practices.


• Contribute to the enhancement of IT audit tools, techniques, and methodologies.


• Monitor industry trends and regulatory developments.


• Enhance audit methodologies and leverage new audit techniques.