Senior Consultant - Technology Risk & IT Audit

About the role

Grant Thornton UAE's Advisory practice is seeking a technically strong Senior Consultant to deliver technology risk, IT audit, cybersecurity, regulatory compliance, resilience and emerging technology engagements. The consultant assesses complex technology environments, identifies control weaknesses, analyses technical evidence and develops practical recommendations, independently managing workstreams and supporting clients in financial services, government, critical infrastructure and other regulated sectors.

Key responsibilities

• Execute IT audits, ITGC reviews, technology risk assessments, application control reviews, pre- and post-implementation reviews and technology project assurance engagements.
• Review controls across access management, privileged access, change management, IT operations, interfaces, automated controls, backup, incident management, logging and monitoring.
• Assess cybersecurity maturity, gaps, compliance and regulatory readiness against UAE Information Assurance Standards, NIST CSF, ISO 27001, CIS Controls, PCI DSS, SWIFT CSP and Central Bank frameworks.
• Review core banking and critical business applications, including access, configuration, maker-checker controls, interfaces, batch processing and resilience.
• Assess cybersecurity solutions such as IDS/IPS, firewalls, WAF, PAM, IAM, EDR/XDR, DLP, SIEM, SOAR, vulnerability management, email security and cloud security tools.
• Conduct SOC and SIEM assessments, and review vulnerability management, penetration testing, patch management, secure configuration, application security and remediation.
• Perform cloud security reviews for Microsoft Azure, AWS, Microsoft 365 and hybrid environments.
• Assess business continuity, disaster recovery and operational resilience, including BIA, RTO/RPO, recovery testing and third-party dependencies.
• Review data centres, support data protection, privacy, Microsoft Purview, AI governance and emerging technology risk (including ISO 42001 and NIST AI Risk Management Framework).
• Lead client interviews, walkthroughs and evidence reviews; prepare risk matrices, working papers, maturity assessments, reports, dashboards and remediation roadmaps.
• Guide junior team members and review technical outputs.

Required profile

• 4 to 6 years of experience in IT audit, technology risk, cybersecurity, cloud security, regulatory compliance, BCM, disaster recovery or related advisory services.
• Practical experience conducting ITGC, cybersecurity, infrastructure, application, cloud or regulatory assessments.
• Ability to analyse technical evidence and develop clear, defensible findings and recommendations.

Required skills

• Working knowledge of UAE IA, NIST, ISO 27001 and relevant Central Bank cybersecurity or technology risk requirements.
• Experience reviewing security solutions such as PAM, EDR, SIEM, IDS/IPS, DLP, firewalls and vulnerability-management platforms.
• Experience assessing core banking or critical applications, SOC operations, cloud environments, data centres, BCM or disaster recovery.
• Certifications such as CISA, CRISC, CISM, CISSP, ISO 27001 Lead Auditor/Implementer, ISO 22301, ISO 42001, CCSP, AWS Security Specialty, CEH, CREST, OSCP, GIAC or an equivalent.

What we offer

• Competitive compensation package.
• Flexible work arrangements.
• Professional development support.
• Wellbeing and community initiatives.