: Manager – Technology Risk & Controls, IT Audit

Location: Bengaluru

Experience: 7–10 years

Preferred Background: Global Capability Center (GCC) / large multinational setting / IT Firm/ Banks and NBFCs

Role Level: Manager / Lead

Role Overview

We are seeking an experienced Technology Risk & Controls, IT Audit professional with 7–10 years of relevant experience, preferably gained within a Global Capability Center (GCC) or large multinational organization.

The role will be responsible for executing and leading technology risk assessments, IT and security audits, IT controls reviews and assurance activities across applications, infrastructure, cloud and emerging technologies. The individual will work with technology, cybersecurity, risk, internal audit and business stakeholders to identify technology risks, assess control effectiveness and drive improvements to the overall technology control environment.

The ideal candidate will combine strong hands-on audit and controls expertise with knowledge of modern technology environments and emerging capabilities such as AI and Generative AI.

Key Responsibilities

IT Audit & Technology Risk

- Lead and execute risk-based IT and technology audits across enterprise technology environments.
- Perform technology risk assessments and identify key risks, control gaps and improvement opportunities.
- Assess IT General Controls (ITGCs) including user access management, privileged access, change management and IT operations.
- Evaluate the design and operating effectiveness of technology controls.
- Develop audit programs, Risk and Control Matrices (RCMs), testing approaches and working papers.
- Draft clear audit observations, assess associated risks and recommend practical remediation measures.
- Track audit issues and work with stakeholders toward timely remediation and closure.

Enterprise Technology Risk Assessment

- Perform enterprise-level technology and cyber risk assessments.
- Identify inherent risks, evaluate existing controls and assess residual risk.
- Support Risk and Control Self-Assessments (RCSAs) and technology control assessments.
- Develop and maintain risk registers and RCMs.
- Work with stakeholders to identify and establish appropriate remediation plans for material control gaps.

Application & Integrated Audits

- Perform application audits covering application security, access, configuration, change management, interfaces,



data integrity and automated controls.
- Assess application-level controls and technology-dependent business controls.
- Participate in integrated audits alongside business, operational, financial and compliance audit teams.
- Understand end-to-end business processes and identify critical technology dependencies and associated control risks.

IT Infrastructure Technology Audit

- Conduct technology audits across servers, operating systems, databases, networks, data centers and related infrastructure.
- Review access security, configuration management, patching, vulnerability management, monitoring, backup and recovery.
- Assess Disaster Recovery, Business Continuity and technology resilience controls.
- Evaluate infrastructure risks associated with legacy technology and modernization programs.

Cloud Risk & Cloud Readiness

- Conduct cloud readiness, cloud risk and control assessments.
- Evaluate cloud governance, security architecture, IAM, data protection, logging, monitoring, resilience and workload security.
- Assess technology risks associated with cloud migration and transformation programs.
- Exposure to Microsoft Azure, AWS and/or Google Cloud environments is preferred.

AI & Generative AI Capability Given the increasing adoption of AI across risk and assurance functions, the candidate should have working knowledge of AI and Generative AI, including:

- Ability to write effective, structured prompts for Generative AI tools.
- Use AI to support audit planning, risk identification, control mapping and document analysis.
- Apply GenAI for first-pass analysis of policies, procedures, audit evidence and control documentation.
- Use AI for development and review of RCMs, testing procedures, audit observations and management reports.
- Understand the key risks associated with AI, including data confidentiality, security, privacy, governance, model risk and responsible AI.




- Demonstrate awareness of appropriate human review and validation when using AI-generated outputs in audit and assurance activities.

Required Experience & Skills The candidate should have:

- 7–10 years of relevant professional experience in Technology Risk, IT Audit, Cybersecurity Audit, IT Controls and/or Internal Audit.
- Preferably experience within a GCC / Global Capability Center or large multinational organization.
- Hands-on experience performing and/or leading technology audits and risk assessments.
- Strong experience across several of the following:
- IT Audit
- ITGC
- Technology Risk
- Cybersecurity Audit
- Enterprise Risk Assessment
- Internal Audit
- Application Audit
- Infrastructure Audit
- Integrated Audit
- Cloud Risk / Cloud Readiness

- Strong understanding of control design and operating effectiveness testing.
- Ability to translate technical vulnerabilities or control deficiencies into clearly articulated business and technology risks.
- Solid stakeholder-management, documentation, PPT and report-writing skills.
- Ability to work effectively with global stakeholders across technology, cybersecurity, audit and risk functions.

Preferred Framework Knowledge Experience with one or more of the following is desirable:

- COBIT
- NIST Cybersecurity Framework
- ISO/IEC 27001
- COSO
- ITIL
- CIS Controls
- SOX / ITGC
- SOC 1 / SOC 2
- Cloud security and controls frameworks

Preferred Qualifications / Certifications Bachelor’s or Master’s degree in Technology, Engineering, Computer Science, Information Systems, Cybersecurity, Finance or a related discipline.

One or more of the following certifications would be preferred:

- CISA
- CISSP
- CISM
- CRISC
- CIA
- ISO 27001 certification
- Relevant Azure, AWS or GCP security/cloud certification

Candidate Profile The ideal candidate is a hands-on technology risk professional rather than a purely supervisory auditor. They should be comfortable moving between detailed control testing and discussions with senior technology and risk stakeholders. Experience in a GCC environment is particularly relevant where the individual has worked with global technology platforms, geographically distributed stakeholders, centralized control environments and global audit/risk teams.

They should also demonstrate curiosity around AI and GenAI, with the ability to use prompt engineering and AI-assisted techniques thoughtfully within the audit and risk lifecycle.

📌 Manager- Technology Risk & Control- IT Audit (Bengaluru)
🏢 Grant Thornton Bharat
📍 Bengaluru