Associate, Information Technology Audit

Group Internal Audit (GIA) supports the HKEX Group in achieving its business objectives, safeguarding its assets and reputation, and raising its control culture awareness through the provision of objective, independent, and insightful assurance to the Board and senior management.

The Associate, IT Audit is responsible for performing high-quality IT audits for the Group in accordance with GIA's audit methodology, and supporting and contributing to departmental initiatives. The role reports to the Head of IT Audit.

Key responsibilities:

• Independently conduct risk-based audits, support the entire audit life cycle, and prepare write-ups for audit issues and reports.
• Identify and escalate potential audit issues and root causes to the Auditor-in-Charge and GIA management for resolution.
• Contribute to continuous risk monitoring and assessment of IT/business operations to identify emerging/high-risk areas for coverage.
• Develop good knowledge of the Group's strategy, products, risk management processes, and operating platforms.
• Stay current with industry developments, business, and IT trends, and conduct research on industry and risk topics.
• Validate remediation of audit issues in an effective and timely manner.
• Participate and contribute to departmental initiatives, such as continuous improvement of GIA's audit methodology.
• Support the preparation of materials for senior management, Audit Committee, and regulators.

Requirements:

• At least 5 years of work experience in internal or external audit, risk management, compliance, cybersecurity, or a related field.
• A university graduate in a relevant discipline (e.g., Accounting, Finance, Business Administration, Technology).
• Possess at least one relevant professional qualification (e.g., CPA, CIA, CFA, FRM, CISA, CISM, CISSP, CEH, CCSP/CCAK, CSX-P).
• Good understanding of industry cybersecurity standards, such as NIST Cybersecurity Framework, ISO 27001, CIS.
• Good understanding of underlying IT and cybersecurity risks, application controls, assessment practices, and various IT security software, operating systems, databases, cloud, networking technologies, and emerging technology risks.
• Team-oriented with a strong sense of ownership and individual accountability.
• Independent and motivated with the ability to multi-task and remain organized.
• Demonstrate agility and the ability to operate in a fast-changing environment.
• Good communication and relationship management skills.
• Experience in leveraging data and technology is an advantage.