Responsibilities

1. IT Audit Execution (Infra + Application)

- Conduct audits covering network, servers, cloud, endpoints, databases, IAM, DR/BCP, logging/SIEM, and security controls.
- Perform audits for core insurance applications (Policy Admin, Claims, Underwriting, CRM, Digital Channels & all business functions).
- Review ITGCs, application controls, access controls, SoD, interface controls, batch jobs & change management.
- Validate secure SDLC/DevSecOps processes: SAST/DAST/SCA, release management, secrets management, and CI/CD controls.
- Perform evidence-based testing, sampling, walkthroughs, and documentation.
- Prepare audit observations, risk ratings, and recommend actionable remediation.
- Handon managing ISO audits and continuous monitoring of ISO controls

2. Technology Risk Management

- Contribute to the Tech Risk Register: identify risks, assess severity, track controls, and monitor treatment plans.
- Participate in risk assessments for new projects, changes, cloud adoption, and third-party onboarding.
- Support creation and review of policies, SOPs, security standards, and control frameworks.

3. Compliance (Insurance Sector)

- Assist in compliance activities aligned to IRDAI Cybersecurity Guidelines, IT Governance Circulars, DPDP obligations, outsourcing guidelines, and business continuity expectations.
- Support regulatory audits, internal audits, and external assessments (ISO, NIST, DR drills).
- Collect evidence and maintain compliance dashboards.

5. Control Monitoring & Reporting

- Support operationalization of Continuous Controls Monitoring (CCM).
- Prepare dashboards on audit status, open issues, compliance KPIs, and control health.




- Work with Infra/App teams to validate closure of findings.

6. Stakeholder Engagement

- Coordinate with Infra, Application, Cloud, DevOps, SOC, Security Engineering, and Business teams.
- Clearly communicate risks, control gaps, and required remediation in a non-technical and business-friendly manner.

7. AI Capabilities

- Ability to use AI tools to analyze large audit datasets, logs, configurations, and evidence for anomalies or control gaps.
- Familiarity with AI‑based pattern detection for identifying control deviations, misconfigurations, and risky behaviors.
- Ability to interpret risk insights generated by AI/ML‑driven security tools (SIEM/SOAR, CSPM, threat intelligence platforms).
- Experience using AI copilots (e.g., Microsoft Copilot, security copilots) to speed up:
- Control testing

- Log correlation

- Report drafting

- Evidence summarization

Qualifications

Technical Skills

- IT audits covering Infra & Apps.
- Strong understanding of:
- ISO 27001, NIST CSF, COBIT, CIS benchmarks, OWASP
- Network & cloud security fundamentals
- IAM, PAM, MFA, access certification
- Vulnerability management & patch governance
- SDLC/DevSecOps controls

- Experience in insurance domain processes is mandatory.

Soft Skills

- Strong documentation and audit-report writing.
- Analytical thinking & structured problem solving.
- Ability to collaborate across multiple stakeholders and challenge where necessary.
- Transparent communication and the ability to present risks effectively.

Qualifications

Education

- Bachelor’s degree in Engineering/IT/Computer Science or related field.

Certifications (Preferred, not mandatory)

CISA, ISO 27001 Lead Auditor, CRISC, Security+, AWS/Azure Security Fundamentals.

📌 Deputy Manager - GRC (India)
🏢 Universal Sompo General Insurance
📍 India