Senior IT & Information Security Auditor

Senior IT & Information Security Auditor

Location: Baghdad, Iraq

Employment Type: Full-Time

Department: Internal AuditAbout the RoleBank of Baghdad is looking for a Senior IT & Information Security Auditor to join our Internal Audit team.The successful candidate will be responsible for conducting risk-based audits of IT systems, information security, and cybersecurity controls to assess technology-related risks, evaluate the effectiveness of internal controls, and ensure the security and reliability of banking systems and data.This role requires strong technical expertise in IT auditing, cybersecurity, information security risk management, and regulatory compliance, with the ability to identify control weaknesses, recommend improvements, and contribute to strengthening the Bank's IT governance and security framework.Key ResponsibilitiesPlan and conduct IT and Information Security audits in accordance with risk-based internal audit methodologies.Evaluate the design and operating effectiveness of IT General Controls (ITGC) and information security controls.Review network security, databases, banking applications, IT infrastructure, and access management controls.Assess user access management, privileged access, segregation of duties, and system authorization controls.Evaluate vulnerability management processes, cybersecurity incident management, and security monitoring controls.Review Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) to assess operational resilience and recovery capabilities.Identify and assess risks associated with IT systems, applications, databases, and technology infrastructure.Evaluate third-party IT service providers and technology outsourcing risks.Review IT policies, procedures, and security practices against applicable regulatory requirements and recognized industry frameworks.Identify control weaknesses, security vulnerabilities, and potential operational risks, and recommend corrective actions.Prepare comprehensive audit reports outlining findings, risk assessments, recommendations, and management action plans.Monitor and follow up on the implementation of agreed corrective actions to ensure timely resolution of audit findings.RequirementsBachelor's degree in Computer Engineering, Computer Science, Information Security, Cybersecurity, or a related field.3–5 years of relevant experience in Internal Audit, IT Audit, Information Security Audit, or related areas.Strong understanding of IT General Controls (ITGC), cybersecurity principles, and IT risk management.Experience in evaluating IT infrastructure, network security, databases, applications, and access controls.Knowledge of information security controls, vulnerability management, and cybersecurity incident response.Good understanding of business continuity management and disaster recovery procedures.Familiarity with COBIT, NIST, PCI DSS, SWIFT CSP, and ITIL frameworks.Knowledge of IT governance, risk assessment methodologies, and internal control frameworks.Experience in preparing audit reports, documenting findings, and monitoring corrective action plans.Good analytical and data interpretation skills, including the use of Microsoft Excel, Power BI, and SQL.Strong analytical, problem-solving, and critical-thinking skills.Excellent written and verbal communication skills.Ability to work independently and collaborate effectively with IT, Information Security, Risk Management, and other departments.High level of professional integrity, objectivity, independence, and confidentiality.Technical KnowledgeStrong knowledge or practical experience in the following areas is highly preferred:IT Audit & Risk-Based AuditingIT General Controls (ITGC)Information Security & CybersecurityIT Governance & Risk ManagementNetwork & Infrastructure SecurityDatabase & Application SecurityIdentity & Access Management (IAM)Privileged Access Management (PAM)Vulnerability & Patch ManagementSecurity Incident ManagementBusiness Continuity Planning (BCP)Disaster Recovery Planning (DRP)Third-Party IT Risk ManagementCOBIT & ITIL FrameworksNIST Cybersecurity FrameworkPCI DSS ComplianceSWIFT Customer Security Programme (CSP)Data Analytics (Excel, Power BI & SQL)Internal Controls & Regulatory ComplianceCertificationsRelevant professional certifications are considered a strong advantage, particularly:CISA – Certified Information Systems AuditorCISM – Certified Information Security ManagerCRISC – Certified in Risk and Information Systems ControlCIA – Certified Internal AuditorWorking Days & HoursWorking Days: Sunday to Thursday.Sunday – Wednesday: 8:00 AM – 3:30 PM.Thursday: 8:00 AM – 2:30 PM.Weekly Days Off: Friday and Saturday.Official Holidays: All officially declared Iraqi government public holidays are observed, subject to applicable banking regulations and the Bank's policies.Medical Insurance: Medical insurance coverage provided by the Bank.Social Insurance: Social security coverage in accordance with Iraqi labor laws and applicable regulations.If you have experience in IT auditing, information security, cybersecurity, or technology risk management and are interested in advancing your career within the banking sector, we encourage you to apply.Join Bank of Baghdad and contribute to strengthening our IT governance, cybersecurity, risk management, and information security standards.