1. IT Audit Execution (Infra + Application) • Conduct audits covering network, servers, cloud, endpoints, databases, IAM, DR/BCP, logging/SIEM, and security controls. • Perform audits for core insurance applications (Policy Admin, Claims, Underwriting, CRM, Digital Channels & all business functions). • Review ITGCs, application controls, access controls, SoD, interface controls, batch jobs & change management. • Validate secure SDLC/DevSecOps processes: SAST/DAST/SCA, release management, secrets management, and CI/CD controls. • Perform evidence-based testing, sampling, walkthroughs, and documentation. • Prepare audit observations, risk ratings, and recommend actionable remediation. • Handon managing ISO audits and continuous monitoring of ISO controls 2. Technology Risk Management • Contribute to the Tech Risk Register: identify risks, assess severity, track controls, and monitor treatment plans. • Participate in risk assessments for new projects, changes, cloud adoption, and third-party onboarding. • Support creation and review of policies, SOPs, security standards, and control frameworks. 3. Compliance (Insurance Sector) • Assist in compliance activities aligned to IRDAI Cybersecurity Guidelines, IT Governance Circulars, DPDP obligations, outsourcing guidelines, and business continuity expectations. • Support regulatory audits, internal audits, and external assessments (ISO, NIST, DR drills). • Collect evidence and maintain compliance dashboards. 5. Control Monitoring & Reporting • Support operationalization of Continuous Controls Monitoring (CCM). • Prepare dashboards on audit status, open issues, compliance KPIs, and control health. • Work with Infra/App teams to validate closure of findings. 6. Stakeholder Engagement • Coordinate with Infra, Application, Cloud, DevOps, SOC, Security Engineering, and Business teams. • Clearly communicate risks, control gaps, and required remediation in a non-technical and business-friendly manner. 7. AI Capabilities • Ability to use AI tools to analyze large audit datasets, logs, configurations, and evidence for anomalies or control gaps. • Familiarity with AI‑based pattern detection for identifying control deviations, misconfigurations, and risky behaviors. • Ability to interpret risk insights generated by AI/ML‑driven security tools (SIEM/SOAR, CSPM, threat intelligence platforms). • Experience using AI copilots (e.g., Microsoft Copilot, security copilots) to speed up: • Control testing • Log correlation • Report drafting • Evidence summarization Technical Skills • IT audits covering Infra & Apps. • Strong understanding of: • ISO 27001, NIST CSF, COBIT, CIS benchmarks, OWASP • Network & cloud security fundamentals • IAM, PAM, MFA, access certification • Vulnerability management & patch governance • SDLC/DevSecOps controls • Experience in insurance domain processes is mandatory. Soft Skills • Strong documentation and audit-report writing. • Analytical thinking & structured problem solving. • Ability to collaborate across multiple stakeholders and challenge where necessary. • Clear communication and the ability to present risks effectively. Qualifications Education • Bachelor’s degree in Engineering/IT/Computer Science or related field. Certifications (Preferred, not mandatory) CISA, ISO 27001 Lead Auditor, CRISC, Security+, AWS/Azure Security Fundamentals.