Senior Audit Manager - T&O - Information & Cyber Security (Singapore, Hong Kong)

Job Summary

This role could be based in Singapore or Hong Kong. When you start the application process you will be presented with a drop-down menu showing all countries, please ensure that you only select a country where the role is based

The Group Internal Audit & Investigations (GIAI) at Standard Chartered Bank is seeking a strong Senior Audit Manager to join the Information and Cyber Security (ICS) team. The role requires solid technical expertise across identity and access management, vulnerability management, code security, security operations, threat intelligence, red and purple teaming, penetration testing, and ICS standards such as NIST and CIS, along with risk management experience. Exposure to AI security and digital assets is highly desirable.  

Key Responsibilities

Strategy
•    Support the HOA in the development of the GIA risk assessment and development of an appropriate audit plan for the assigned portfolio;
•    Propose audits for coverage during the audit cycle based on their knowledge of the business;
•    Carry out their role in line with the Audit Charter and remain independent from management and free from interference; and
•    Provide clear, effective supervision and leadership to the audit teams and champion the implementation of the strategy.
Business
•    Perform, support, or lead where directed, the planning, fieldwork, and reporting of internal audit engagements to deliver agreed assurance objectives to established GIA standards and timelines; and
•    Deliver audits/assignments within budget and drive efficiency to support cost save objectives;

Processes
•    Act as Team Manager or Team Lead to lead the delivery of high risk audits with integrated teams;  
•    Execute audit work and issue validation in an efficient and effective manner, within the given budget and timelines;
•    Provide clear guidance, detailed review and supervision of the audit team’s work, so that audit deliverables meet quality standards;
•    Clearly identify the risks and impact of issues during issue writing, agreeing these issues with management and obtaining quality management action plans to mitigate the risk;
•    Provide guidance to the team on business/ audit technical knowledge and management skills;
•    Champion innovation and increase the use of leading edge methods, such as artificial intelligence and data analytics, in audit assignments; and
•    Track the implementation/delivery of the agreed issues and action plans for the audits assigned, understanding the key risks arising, provide advice on resolution of issues to auditees/action plan owners and escalate audit findings that remain unresolved.

People & Talent 
•    Share knowledge, skills and experience with team members and the wider GIA and provide advisory to internal auditors from both business and technology on Information and Cyber Security;
•    Assist in conducting training sessions for GIA Stakeholders on topics related to Information and Cyber Security;
•    Support the function in audit talent development and career growth;
•    Develop skills and competencies to support the function in ensuring future readiness; and
•    Contribute to building a high performing collaborative function through regular feedback and coaching;
Risk Management
•    Complete relevant risk assessment activities in a timely and effective manner, including the completion of the Risk Assessment template;
•    Assist in continuous auditing and monitoring of key risks in Information and Cyber Security; and
•    Follow changes in the laws and regulations to identify emerging risks.

Governance
•    Assist the HOA to manage the relevant Product/Country clients, and establish good working relationships to help the businesses improve the control environment and keep updated with changes in the business impacting their risk profile;
•    Ensure clear communication of findings/issues/root causes to all relevant clients and monitor/escalate any overdue actions plans to the appropriate business manager and/or governance committee for resolution; and
•    Ensure timely escalation of delays in execution of audit work, both to auditee management and GIA management.
Regulatory & Business Conduct
•    Display exemplary conduct and live by the Group’s Values and Code of Conduct;
•    Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct; and
•    Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.
Key Stakeholders
•    Designated business stakeholders, typically related to individual audit assignments and the Information and Cyber Security portfolio; and
•    GIA stakeholders – team leaders, team members, team managers, Product, Functional, Country and Regional Heads of Audit.
Other Responsibilities
•    Embed Here for good and Group’s brand and values in GIA; and
•    Perform other responsibilities assigned under Group, Country, Business or Functional policies and procedures.

Our Ideal Candidate

• 12+ years of experience in IT auditing, information security, or risk management.
• In-depth understanding of Information and Cyber Security risk management and associated control requirements;
• Strong communicator, both written and verbal, with ability to clearly explain complicated technical issues in business terms to audit and business management;
• Team management, team leading, coaching and mentoring, problem solving and conflict management, multi-tasking, risk assessment and collaboration.
• Strong understanding of identity and access management, vulnerability management, code security, security operation centre, threat intelligence, red and purple teaming, penetration testing, ICS related industry standards such as NIST and CIS, and risk management. 
• IT infrastructure components, including servers, networks, databases, and cloud services would be a plus. 
• Knowledge of cybersecurity principles, frameworks, and best practices.
• Proficiency in audit tools and techniques.
• Professional certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Cloud Security Professional (CCSP), and Global Information Assurance Certification (GIAC) related certificates are highly desirable. Other designations such as Certified in Risk and Information Systems Control (CRISC) and Certified Information Security Manager (CISM), and Certified Internal Auditor (CIA) are a plus.
• Excellent analytical and problem-solving abilities with a keen attention to detail
• Bachelor’s degree in information technology, Computer Science, Information Systems, or a related field. A master's degree is a plus.

Role Specific Technical Competencies

• Group Information and Cyber Security Risk
• Information and Cyber Security domain knowledge (e.g. Identity & Access Management, Third Party Risk Management)
• Audit
• Risk and Controls
• Microsoft Word/Excel/PowerPoint