Our client is a well-established insurance company with a strong presence in Hong Kong. As part of their continued commitment to governance, risk management and technology control enhancement, they are looking for an experienced IT Audit professional to join their internal audit team.

This role would be suitable for someone with solid IT audit experience, ideally gained from insurance, banking or other financial services.

Key Responsibilities

1. Plan and execute IT audit assignments across key technology areas, including IT general controls, application controls, cybersecurity, infrastructure, cloud, data governance, business continuity and third-party technology risk.
2. Assess the effectiveness of IT controls, identify control gaps, and provide practical recommendations to strengthen the overall control environment.
3. Review system development, change management, access management, incident management, disaster recovery and other key IT processes.
4. Work closely with IT, business units, risk, compliance and senior management to communicate audit findings and agree on remediation plans.
5. Provide value-added advice on IT governance, technology risk management and control enhancement initiatives.
6. Follow up on audit issues and ensure agreed action plans are implemented in a timely manner.
7. Support the annual audit planning process by identifying key technology and cyber risk areas.
8. Lead or supervise audit engagements, including scoping, fieldwork, reporting and quality review.
9. For Senior Manager level, provide coaching and guidance to junior team members and contribute to methodology enhancement.
10. Keep abreast of regulatory requirements and industry practices relevant to insurance, technology risk, cybersecurity and operational resilience.
11. Support ad hoc reviews, regulatory-related projects and management requests where required.

Requirements

1. Bachelor’s degree in Information Systems, Computer Science, Accounting, Finance, Risk Management or related disciplines.
2. Minimum 6–10 years of relevant experience in IT audit, technology risk, cybersecurity, IT governance or internal audit.
3. Experience gained from insurance, banking and financial institutions. Big 4 or consulting firms background would be highly preferred.
4. Solid understanding of IT general controls, application controls, cybersecurity, cloud, infrastructure, data protection and business continuity.
5. Professional qualifications such as CISA, CISSP, CISM, CRISC and CIA would be an advantage.
6. Strong communication skills with the ability to engage both technical and non-technical stakeholders.
7. Good report writing, analytical and problem-solving skills.
8. Proficiency in English and Chinese.