IT Auditor

Under the supervision of the Head of Internal Audit Information System:

Required experience & competencies

Experience

• 2 to 5 years of professional experience in an IT audit / technology risk role, ideally gained in a multinational company within a regulated financial services environment and/or within an audit firm.

Personal Competencies

• Highest ethics and integrity, with a strong sense of confidentiality and professional discretion.
• Excellent level of English required (as the majority of oral and written communications are in English), as well as in French
• Strong communication and interpersonal skills; ability to work effectively across cultures and geographies in an international environment.
• Strong analytical skills, good overview, critical sense and ability to deal with complex issues and influence change.
• Team player who can also work independently and rigorously, applying due professional care and in conformity with the Global Internal Audit Standards (IIA).
• Position based in Paris (16th district) with global travel up to ~20% (Americas, Europe, Asia). 

Technical Competencies

• Demonstrated understanding of IT audit and technology risk concepts, including the ability to assess control design and operating effectiveness (e.g., ITGC / ITAC).
• Proven exposure to auditing one or more of the following domains: Data governance, Application development / SDLC, Project management / IT change delivery, Third‑party / cloud assurance, Technology infrastructure (databases, OS, networks), Cybersecurity, or Operational resilience (BCP/DR, resilience testing, incident readiness).
• Good working knowledge of at least one major control framework/standard such as COBIT, ISO 27001 or the NIST Cybersecurity Framework, and awareness of relevant regulatory requirements (e.g., the EU Digital Operational Resilience Act – DORA), with the ability to translate them into audit scope and test procedures.
• Awareness of emerging IT risks and internal audit best practices, such as evolving cloud/third-party dependencies, resilience expectations, and new security threats.
• Strong interest in new technologies (AI, Data Science, etc.) and the ability to translate that interest into practical audit value (risk identification, analytics, sharper control testing).

Education

• Master’s degree in IT Audit, Information Systems,  Cybersecurity, Data Engineering or a related field.
• Professional credentials (e.g., CISA, CIA, CISSP) or professional qualifications (ITIL, Project Management) are seen as a strong plus.

• Understand the business and technology environment; partner with stakeholders to provide relationship management of the associated risk and control environment.
• Plan and execute IT audit engagements in accordance with internal audit policies, methodology, applicable regulatory requirements, and the Global Internal Audit Standards (IIA).
• Assess the design and operating effectiveness of IT General Controls and Application Controls (ITGC/ITAC) using appropriate audit techniques (inquiry, observation, inspection, and re-performance where relevant).
• Apply a data-driven approach to audits where relevant (risk assessment, control testing, and generation of actionable insights).
• Proactively seek ways to make the best use of data as part of our IT audit process including to inform our understanding of risks, test controls and provide relevant insights to the business.
• Contribute to defining audit scope and criteria by leveraging relevant frameworks/standards (e.g., COBIT, ITIL, ISO 27001, NIST CSF) and considering key regulatory expectations where applicable (e.g., DORA: governance, incident management, resilience testing, third‑party risk).
• Deliver high-quality audits, reviews, and advisory assignments on time, contributing across all phases: planning/scoping, fieldwork, and reporting.
• Communicate and discuss findings with business unit management
• Develop audit reports which identify deficiencies and underlying root causes; provide recommendations to mitigate/address deficiencies while adding value.
• Conduct research and successfully complete assigned training requirements necessary to maintain relevance.
• Work closely with Group Tech & Data Departments and business units at all levels to develop recommendations for audit findings, business process optimization, internal control and compliance.
• Perform follow-up work to assess the implementation status (and where applicable, effectiveness) of agreed actions and report progress as required.