1. IT Audit Execution (Infra + Application)
network, servers, cloud, endpoints, databases, IAM, DR/BCP, logging/SIEM
, and security controls.
core insurance applications
(Policy Admin, Claims, Underwriting, CRM, Digital Channels & all business functions).
ITGCs, application controls, access controls, SoD, interface controls, batch jobs & change management
.
- Validate secure SDLC/DevSecOps processes:
SAST/DAST/SCA
, release management, secrets management, and CI/CD controls.
- Perform evidence-based testing, sampling, walkthroughs, and documentation.
- Prepare
audit observations
, risk ratings, and recommend actionable remediation.
- Handon managing ISO audits and continuous monitoring of ISO controls
2. Technology Risk Management
- Tech Risk Register: identify risks, assess severity, track controls, and monitor treatment plans.
- Participate in risk assessments for
new projects, changes, cloud adoption, and third-party
.
- Support creation and review of
policies, SOPs, security standards, and control frameworks
.
3. Compliance (Insurance Sector)
- Assist in compliance activities aligned to
IRDAI Cybersecurity Guidelines, IT Governance Circulars, DPDP obligations
, outsourcing guidelines, and business continuity expectations.
- Support regulatory audits, internal audits, and external assessments (ISO, NIST, DR drills).
- Collect evidence and maintain compliance dashboards.
5. Control Monitoring & Reporting
- Support operationalization of
Continuous Controls Monitoring (CCM)
.
audit status, open issues, compliance KPIs
, and control health.
- Work with Infra/App teams to validate closure of findings.
6. Stakeholder Engagement
- Coordinate with Infra, Application, Cloud, DevOps, SOC, Security Engineering, and Business teams.
- Clearly communicate risks, control gaps, and required remediation in a non-technical and business-friendly manner.
7. AI Capabilities
- Ability to use AI tools to analyze large audit datasets, logs, configurations, and evidence for anomalies or control gaps.
- Familiarity with AI‑based pattern detection for identifying control deviations, misconfigurations, and risky behaviors.
- Ability to interpret risk insights generated by
AI/ML‑driven security tools
(SIEM/SOAR, CSPM, threat intelligence platforms).
- Experience using AI copilots (e.g., Microsoft Copilot, security copilots) to speed up:
- Control testing
- Log correlation
- Report drafting
- Evidence summarization
Technical Skills
ISO 27001
,
NIST CSF
,
COBIT
,
CIS benchmarks
,
OWASP
- Network & cloud security fundamentals
- IAM, PAM, MFA, access certification
- Vulnerability management & patch governance
- SDLC/DevSecOps controls
- Experience in
insurance domain processes
is mandatory.
Soft Skills
- Strong documentation and audit-report writing.
- Analytical thinking & structured problem solving.
- Ability to collaborate across multiple stakeholders and challenge where necessary.
- Clear communication and the ability to present risks effectively.
Qualifications
Education
- Bachelor’s degree in Engineering/IT/Computer Science or related field.
Certifications (Preferred, not mandatory)
CISA
,
ISO 27001 Lead Auditor
,
CRISC
,
Security+
,
AWS/Azure Security Fundamentals
.
