IT Audit Specialist

About the role

Deriv is hiring an IT Audit Specialist in Dubai for a full-time, hands-on individual contributor role focused on technology and cybersecurity assurance. The specialist delivers independent, evidence-led IT audit work that strengthens the security, reliability and governance of the technology supporting Deriv's international business, examining technical controls, analysing system evidence and investigating weaknesses.

Key responsibilities

• Plan IT audit work, support risk assessments, walkthroughs and the definition of audit scope, objectives and testing programmes.
• Test controls covering identity and privileged access, infrastructure and network security, vulnerability management, security monitoring, incident response and third-party controls.
• Review cloud and engineering practices, including cloud configuration, secure development, CI/CD pipelines, change management, application security and secrets management.
• Assess application and data controls, automated business controls, interfaces, data integrity and protection, and controls for AI-enabled systems.
• Evaluate technology resilience, including backup and recovery, disaster recovery testing and service availability.
• Analyse technical evidence such as configurations, access records, logs, change histories and test results, and investigate exceptions.
• Document findings in clear working papers and validate remediation by reviewing closure evidence and retesting controls.
• Work with engineering, security and technology teams while maintaining independence, confidentiality and professional scepticism.
• Use analytics, scripts, automation and responsibly governed AI tools to improve testing, and senior specialists lead workstreams and mentor less-experienced auditors.

Required profile

• Relevant IT audit or technology assurance experience, ideally in regulated financial services, fintech or a similar environment.
• Experience testing IT controls, assessing technical evidence and documenting audit conclusions.
• Working knowledge of cloud, infrastructure, cybersecurity, identity and access management, software development, application controls and technology resilience.
• Knowledge of risk-based auditing, the IIA Global Internal Audit Standards and ISACA IT audit guidance, with familiarity with COBIT, NIST and ISO/IEC 27001.
• Ability to turn technology risks and regulatory requirements into practical audit tests and explain technical weaknesses in business terms.
• Excellent written and spoken English, and a relevant degree in information systems, computer science, cybersecurity or a related field.
• CISA, CIA or an equivalent audit qualification is preferred.