Senior Associate, IT Auditor - Financial Services Assurance

About the role

EY's Technology Risk team helps banks, insurers, asset managers and payment institutions show that their technology and cyber controls meet the standards expected by MAS. As a Senior Associate IT Auditor, you will lead and run regulatory and attestation-based technology audits against the MAS TRM Guidelines, MAS Notices, SOC 1 / SOC 2 and ISO 27001, across a portfolio of regulated clients, with experienced managers and a clear path to leading your own engagements.

Key responsibilities

• Audit against MAS expectations: assess clients' technology and cyber risk practices against the MAS TRM Guidelines and relevant Notices (e.g. MAS Notice 655 / Cyber Hygiene), identify gaps and judge what regulators care about
• Deliver engagements: plan and run IT reviews, scope the right controls and assess both design adequacy and design effectiveness
• Tackle key risks: AI, cloud, third-party / outsourcing, cyber resilience, data governance and business continuity / disaster recovery
• Write clear, well-evidenced findings and practical recommendations, and explain them to senior client stakeholders
• Manage scope, budget and timeline, and coach the associates working alongside you
• Keep up with regulatory developments and emerging technologies

Required profile

• 3-6 years in technology audit, IT risk or technology assurance, in a professional services firm or in the internal audit / second-line technology risk function of a bank, insurer, asset manager or regulated company
• Hands-on experience delivering regulatory or framework-based audits such as MAS TRM reviews, SOC 1 / SOC 2 attestations or ISO 27001 assessments
• Working knowledge of the MAS TRM Guidelines and related Notices, or experience auditing a MAS-regulated entity
• Degree in Information Systems, Computer Science, Accounting & IT, Engineering, Cybersecurity or equivalent practical experience
• Clear written and verbal communication, able to turn technical findings into business terms

Required skills

• Nice to have: CISA, CRISC or CISM (certification support offered)
• Nice to have: NIST CSF, COBIT or ITIL
• Nice to have: AWS, Azure or GCP
• Nice to have: SQL, Python, Alteryx or Power BI

What we offer

• A clear path to Manager with increasing ownership of engagements
• Certification support including study leave, exam sponsorship and fee coverage for CISA and related qualifications
• Hybrid working, typically three days in the office and two days remote per week