Senior Auditor, IT (Digital Infrastructure)

Role Overview

Senior Auditor, IT (Digital Infrastructure) at ADNOC, based in Abu Dhabi.

Role Purpose

Perform end-to-end audit engagements in Digital Infrastructure across ADNOC and Group Companies, applying risk and control concepts to identify potential issues. Serve as subject matter expert in periodic Risk Assessments and development of Risk-Based Work Plans focused on Infrastructure Security, including vulnerability assessments and penetration testing at infrastructure and network layers.

Key Responsibilities

Internal Audit Planning

• Develop the audit universe to ensure coverage of Digital Infrastructure and cybersecurity risks aligned with other Digital & Technology risk areas including digital governance, operational technology, process, applications, technology interface, and emerging technologies that could affect ADNOC business operations.
• Review and update the Digital & Technology audit universe specifically for Digital Infrastructure and Network.
• Develop and implement strategic initiatives such as Infrastructure Assurance Plan that impact group-wide audit plans and oversee execution to ensure objectives are fulfilled.

Audit Execution

• Perform audits, advisory engagements, and other influencing activities in highly technical areas of current and emerging technologies within ADNOC and Group Companies.
• Develop detailed audit programs and Risk & Control Matrix for assigned audits, including objectives, potential risks, key controls, audit procedures, and audit techniques and tools to evaluate governance, risks, and controls processes, and submit to management for review and approval.
• Ensure adequate working papers and all relevant information are continuously documented and updated in the automated Audit Management System in accordance with predefined templates and audit procedures.
• Ensure approved audit objectives are met with adequate coverage of all relevant areas and sufficient audit evidence is obtained to support conclusions and recommendations in accordance with professional audit standards.

Audit Reporting

• Prepare audit reports with conclusions expressing professional opinions on the adequacy and effectiveness of risk management, control systems, and efficiency of activities carried out.
• Recommend practical improvement options to rectify reported deficiencies for Department Manager review.
• Recommend practical enhancements in Digital and Technology governance, risks, and control processes to assist achievement of company business objectives.

Qualifications & Experience

• Bachelor's Degree in Computer Science, related Technology discipline, or equivalent.
• 8–10 years of relevant experience in Digital & Technology or IT internal auditing.
• Minimum 5+ years of work experience in Digital Infrastructure and cybersecurity domain.
• Advanced technical knowledge of core infrastructure, network components (routers, switches, firewalls), cloud security, different operating systems, databases, virtualization technologies, and security operations.
• Sound knowledge and extensive experience in technology-related risks in emerging areas such as Cloud, Internet of Things (IoT), Zero-Trust / Defense In-Depth architecture, Identity and Access Management, digitalization, and automation.
• Strong hands-on experience conducting vulnerability assessments and penetration testing at infrastructure, network, and system layers. Bug bounty hunting is an added advantage.
• Exposure in reviewing infrastructure platforms hosting AI/ML solutions to assess related risks, security controls, and governance aspects across the AI technology stack is an advantage.
• In-depth knowledge of Digital processes including business continuity and disaster recovery, enterprise architecture, infrastructure review (on-premises and cloud), access-right management, change management, and DevOps.
• In-depth knowledge of International Professional Practices Framework for IT Assurance / IT Assurance Framework (ITAF) and related frameworks and standards such as COBIT, ITIL, ISO 27000, ISO 22301, and NIST, and their interpretation and application to IS/IT auditing practice.
• Experience managing and tracking time for different Internal Audit-related activities.
• Expertise in collecting and analyzing complex data using data analytics tools, evaluating information and systems, and drawing logical conclusions.
• Extensive knowledge of planning and project management areas.
• Awareness and knowledge of Enterprise Resource Planning (ERP) and Operational Technology (OT) processes and systems (preferred).

Skills & Certifications

• IT audit certification, CISA, is mandatory or must be obtained within one year of joining.
• Other related certifications including GIAC, CISSP, OSCP, and CISM are preferred.
• Technical certifications including CCNA, CCIE, Azure, CCSK, CCSP, and GPE are desirable.