Senior Information Technology Auditor

About the role

Meydan Free Zone is seeking a Senior Information Technology Auditor to strengthen its IT Governance, Risk and Compliance (GRC) framework. Reporting to the Internal Audit Manager, you will lead ISO 27001 and DESC ISR compliance initiatives, coordinate audits, and manage risk documentation across the organization’s technology environment.

Key responsibilities

• Conduct risk‑based IT audits, evaluating IT General Controls, application controls, and governance processes.
• Develop, maintain and review IT policies, standards, procedures, and governance documentation aligned with ISO 27001, DESC ISR and other regulations.
• Manage the IT risk register, Business Impact Analysis and support technology and third‑party risk assessments.
• Coordinate internal and external IT audits, including ISO 27001 surveillance, evidence collection, remediation tracking and audit readiness.
• Lead Vulnerability Assessment and Penetration Testing (VAPT) activities and ensure timely remediation.
• Support vendor security and compliance assessments, reviewing security certifications, SOC reports and contractual obligations.
• Prepare compliance dashboards, audit reports and management updates while maintaining centralized documentation.
• Promote information‑security awareness and assist Business Continuity and Disaster Recovery planning and testing.

Required profile

• Bachelor’s degree in IT, Computer Science, Information Security, Cybersecurity or a related field.
• 4–7 years of experience in IT audit, IT governance, risk & compliance or information security.
• Working knowledge of ISO/IEC 27001:2022 and regional frameworks such as Dubai Electronic Security Center (DESC) ISR.
• Familiarity with VAPT processes, IT risk registers and third‑party risk management.
• Strong documentation, report‑writing and stakeholder coordination skills.
• Excellent English communication; additional languages are a plus.

Required skills

• ISO 27001 compliance
• Vulnerability Assessment and Penetration Testing (VAPT)
• IT General Controls (ITGC) assessment
• Third‑party/vendor risk management
• SOC report analysis
• Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP)