Senior IT Internal Auditor

Albawani | البواني; Riyadh; On-site; SAR 180,000 - 290,000; Full time

Job summary

Albawani is seeking a Senior IT Internal Auditor to plan, execute, and lead IT audit engagements across the organization, assessing IT controls, risk management, and governance.

The role requires 4–7 years in IT auditing, strong ITGC and ERP (Oracle, SAP) experience, and knowledge of cybersecurity. CISA highly preferred; CIA/CRISC/CISSP also valued for advisory input on system implementations.

Qualifications

• 4–7 years in IT auditing or IT risk.
• Strong ITGC, application controls, and security knowledge.
• Experience auditing ERP systems (Oracle, SAP).
• Familiarity with IT governance, cybersecurity, and infrastructure controls.
• Risk-based audit methodologies experience.
• Bachelor’s degree in Information Technology / Computer Science or related field.
• CISA preferred; CIA/CRISC/CISSP also valued.

Responsibilities

• Lead IT audit engagements based on the approved plan.
• Develop audit scope, programs, and testing procedures.
• Assess IT general controls, application controls, and configurations.
• Evaluate user access management, data integrity, and security controls.
• Identify IT risks and their business impact.
• Ensure compliance with policies and standards (ISO 27001, COBIT, NIST).
• Present findings to management and stakeholders.
• Monitor remediation actions and closure of findings.
• Perform data analysis using audit tools like ACL, IDEA, and Excel.
• Review system logs, integrations, and ERP controls (Oracle, SAP).
• Provide advisory input on IT projects and system implementations.

Skills

IT auditing

IT risk assessment

ITGC

Cybersecurity

Data analysis

Education

Bachelor’s degree in IT / CS

Tools

ACL

IDEA

Excel

Oracle ERP

SAP ERP

Job description

Who we are:

Albawani is one of the leading construction and contracting companies in Saudi Arabia. Established in 1991, the company has grown from a small civil works contractor into a major diversified group with operations across construction, infrastructure, engineering, water and power, and industrial services.

Job Title:

Senior IT Internal Auditor

Role Purpose:

The Senior IT Internal Auditor is responsible for planning, executing, and leading IT audit engagements across the organization to evaluate the effectiveness of IT controls, risk management practices, and governance structures.

Key Activities:

• Lead IT audit engagements based on the approved audit plan
• Develop audit scope, programs, and testing procedures
• Assess IT general controls (ITGCs), application controls, and system configurations
• Evaluate user access management, data integrity, and security controls
• Identify and assess IT risks and their impact on business operations
• Ensure compliance with internal policies and external standards (ISO 27001, COBIT, NIST)
• Evaluate IT governance frameworks and risk management processes
• Assess cybersecurity controls and data protection practices
• Prepare clear and comprehensive audit reports with findings and recommendations
• Present audit results to management and key stakeholders
• Monitor and follow up on remediation actions and closure of audit findings
• Perform data analysis using audit tools (e.g., ACL, IDEA, Excel)
• Review system logs, integrations, and application controls
• Assess ERP systems (Oracle, SAP) for control effectiveness and risks
• Provide advisory support on IT projects and system implementations
• Recommend control enhancements and process improvements

Job Requirements:

• 4–7 years of experience in IT auditing or IT risk
• Strong experience in IT general controls (ITGC), application controls, and security
• Experience auditing ERP systems (Oracle, SAP, etc.)
• Knowledge of IT governance, cybersecurity, and infrastructure controls
• Experience in risk-based audit methodologies
• Bachelor’s degree in Information Technology, Computer Science, or related field
• Professional certifications, preferably holding CISA (Certified Information Systems Auditor) as highly preferred, in addition to CIA, CRISC, or CISSP.