Principal Engineer Cybersecurity Assurance

Key Accountabilities (Duties and Responsibilities)

Proactive GITC Auditing and Vulnerability Identification 30%

• Conduct regular audits of production systems to assess GITC and identify gaps in configurations, security controls, and vulnerabilities.
• Perform a thorough review of access controls, system configurations, data integrity, and compliance with internal policies and industry standards.
• Identify security risks and proactively recommend appropriate remediation actions to mitigate threats.

Risk Control Self-Assessment (RCSA) Documentation 30%

• Work closely with Governance and Compliance teams to document key findings in the RCSA.
• For any gaps or issues that cannot be immediately resolved, ensure they are properly recorded and tracked in the RCSA, with clear action plans for resolution.
• Continuously review and update the RCSA to reflect the current security and compliance posture of production systems.

Collaboration and Reporting 20%

• Provide regular reports and recommendations to management and stakeholders on the status of audits, security risks, and remediation efforts.
• Collaborate with internal teams such as the IT, security, and operations teams to ensure that gaps are effectively closed and issues are remediated in a timely manner.
• Support ongoing compliance initiatives by providing insights into security vulnerabilities and assisting with external audits.

Support and Continuous Improvement 20%

• Assist in the preparation and execution of internal penetration tests and security assessments.
• Continuously assess and improve the current auditing and testing processes for efficiency and effectiveness.
• Provide recommendations on tools, processes, and methodologies to enhance the security posture of production systems.

Job Specifications

• Minimum of 4 years of experience in IT auditing, specifically in GITC, vulnerability assessments, and security controls within production systems.
• Strong knowledge of security frameworks, regulatory standards (ISO 27001, NIST, SOC 2, GDPR), and security testing tools.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field; certifications such as CISA, CISSP, or CISM are preferred.
• Experience as an IT Auditor in GITC, with expertise in auditing production systems, access controls, and the general audit lifecycle.
• Strong attention to detail, communication skills, and ability to identify and resolve risks proactively.
• Excellent analytical and problem-solving skills, with the ability to manage multiple audit tasks and collaborate with cross-functional teams.

Job Dimensions

Reporting Relationships: jobs that report to this position directly and indirectly

Direct Reports - None

Indirect Reports - Governance and Compliance officers

Stakeholder Management: key stakeholders that the position holder will need to liaise/work with to be successful in this role.

Internal

• IT Department
• Enterprise Project Management
• Enterprise Risk Management
• Internal Audit

External

• External Auditors
• Security Consultancy firms