Information Security Auditor

Responsibilities

IT & Cybersecurity Risk Assessment

• Conduct regular risk assessments to identify key IT and cybersecurity risk areas.
• Ensure critical risks are appropriately addressed in the annual IT audit plan.

Audit Execution

• Perform end-to-end audits across IT/IS domains: planning, risk assessment, control testing, reporting, and follow-up.
• Ensure audit processes align with TVS Credit's internal audit standards, RBI guidelines, and applicable industry standards.
• Track and follow up on IS audit open points rigorously to ensure timely closure.

Security Controls & Compliance

• Evaluate the design and effectiveness of controls across infrastructure, applications, and cybersecurity functions.
• Verify compliance with regulatory requirements, internal policies, and security best practices.

Cybersecurity Domain Expertise

• Apply expertise in cybersecurity tools and operations including:
• Network security
• Endpoint and email security
• Cloud security
• Vulnerability management
• Threat modeling (e.g., MITRE ATT&CK framework)
• Red and Blue team simulations
• Assess security operations, change management, and incident response capabilities.

Stakeholder Management

• Build strong working relationships with business, IT, and security leadership teams.
• Communicate audit findings clearly and suggest actionable improvements.

Innovation & Analytical Rigor

• Leverage data analysis techniques on large datasets to uncover risks and validate control performance.
• Apply foundational understanding of AI/ML risks to assess embedded controls.
• Embrace new tools, trends, and practices in information security auditing.