Senior IT & Information Security Auditor

About the role

Bank of Baghdad is looking for a Senior IT & Information Security Auditor to join its Internal Audit team in Baghdad. The auditor conducts risk-based audits of IT systems, information security and cybersecurity controls, evaluates the effectiveness of internal controls and helps strengthen the bank's IT governance and security framework.

Key responsibilities

• Plan and conduct IT and information security audits using risk-based internal audit methodologies.
• Evaluate the design and operating effectiveness of IT general controls (ITGC) and information security controls.
• Review network security, databases, banking applications, IT infrastructure and access management controls.
• Assess user access, privileged access, segregation of duties and system authorization controls.
• Evaluate vulnerability management, cybersecurity incident management and security monitoring controls.
• Review Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP).
• Identify risks in IT systems, applications, databases and infrastructure, and review third-party IT service provider risks.
• Review IT policies and security practices against regulatory requirements and industry frameworks.
• Recommend corrective actions, prepare audit reports and follow up on the implementation of agreed actions.

Required profile

• Bachelor's degree in Computer Engineering, Computer Science, Information Security, Cybersecurity or a related field.
• 3-5 years of experience in Internal Audit, IT Audit, Information Security Audit or related areas.
• Experience evaluating IT infrastructure, network security, databases, applications and access controls.
• Good understanding of business continuity and disaster recovery procedures.
• Ability to work independently and collaborate with IT, Information Security, Risk Management and other departments.

Required skills

• Knowledge of COBIT, NIST, PCI DSS, SWIFT CSP and ITIL frameworks.
• Experience preparing audit reports and monitoring corrective action plans.
• Analytical skills with Microsoft Excel, Power BI and SQL.
• Preferred: CISA, CISM, CRISC or CIA certification.

What we offer

• Working days Sunday to Thursday, with medical and social insurance coverage.