Internal IT Auditor (Regulated Fintech)

We're not hiring someone to run a controls checklist. We're hiring someone to audit the technology the whole group runs on — including the AI we're building — and prove whether it holds up before a regulator, an attacker or an outage proves it doesn't.

Five things sit with you. All of them cover the whole group — every entity, regulated and unregulated, every jurisdiction:

Technology & Security Audit — Auditing the infrastructure and applications the group actually runs on: cloud environments (AWS/GCP), DevOps pipelines, identity and access management, encryption and key management, trading platforms, payment systems, and many more.

IT Governance & Regulatory Assurance — Assessing whether technology governance, change management, resilience and data protection meet both internal standards and external requirements and keeping that view consistent across jurisdictions.

AI & Agent Assurance — Auditing the AI systems and autonomous agents being built and deployed across the group: how models are governed, what data and systems they can reach, whether their permissions are contained, whether their output is reliable, and accountability for what they do.

AI-Driven Audit Transformation — Building the tools. Designing and deploying the automation, analytics and agents the audit function itself runs on, embedding them into daily audit workflow, and testing full populations instead of samples.

Findings, Reporting & Remediation — Producing findings that hold up under challenge, reporting technology risk to management and the Board in language they can act on, and driving remediation until the exposure is measurably smaller.

Audit the technology the group runs on

•      Audit cloud environments, applications, DevOps pipelines, IAM, encryption and key management — hands on, in the environment, not from a control description

•      Audit the core systems the business depends on: trading platforms, payment and settlement flows, client data stores.

•      Identify security and configuration weaknesses before they become a breach, a penalty or an outage, and say what the actual exposure is rather than logging an observation

Assure governance and regulatory compliance across jurisdictions

•      Assess IT governance, change management, third-party technology dependency, data protection and operational resilience against internal standards and regulatory requirements

•      Keep a clear view of what global standards and licensing rules require in each jurisdiction, and where the group is short

•      Track technology regulation as it develops and say what has to change, early enough to act on it

Audit the AI we're building

•      Audit in-house AI tools and agents: model governance, data access, system permissions, escalation limits, human oversight and audit trail

•      Test whether an agent can reach data or take actions beyond what it was authorised to do, and whether anyone would know if it did

•      Assess output reliability and model performance over time, and challenge deployments where accountability for a decision isn't clear

Build the AI the audit function runs on

•      Design and deploy automation, analytics and agents yourself — this is a build role, not a role that uses someone else's tools

•      Embed them into the audit workflow so testing runs continuously across full populations, and auditor time goes to judgment instead of evidence gathering

•      Govern what you build to the same standard you hold the business to: validation, monitoring, and knowing when the output is wrong

Report it, then drive it down

•      Write findings that stand up to challenge from engineers and from senior management — criteria, condition, cause, consequence and correction, every time

•      Report technology and cyber risk to management and the Board so they can act on it, and defend a finding to people who'd rather it weren't true

•      Drive remediation to closure and verify the risk actually fell, rather than accepting that a ticket was closed

You've audited technology in a regulated environment, not just reviewed documentation. 5+ years in IT audit, ideally gained inside fintech, banking, investment services or a VASP. You can dissect a technical architecture, form a view on where it's weak, and defend that view to the engineers who built it.

You're genuinely technical. Proven experience auditing cloud (AWS/GCP), IAM, encryption standards, CI/CD pipelines or blockchain technology. You can read configuration and code well enough to test a control yourself rather than relying on what you were told.

You know the regulation and the standards behind it. Technology risk guidelines, cybersecurity mandates and frameworks such as DORA, ISO 27001 and SOC 2, across multiple jurisdictions. You work to IIA Standards and you know what makes a finding defensible. Degree in Computer Science, Cybersecurity or IT, with CISA required; CRISC, CISM or CISSP are strong advantages.

You build AI, you don't just use it. You've built or deployed something that runs in production — automation, an analytics pipeline, a testing agent — and embedded it into how a team works, not left it as a proof of concept. You're comfortable in large datasets and confident with the statistics behind a model.

You can audit AI, which is not the same as using it. You understand where models fail, how agent permissions sprawl, what an AI system's audit trail should look like, and how to hold a deployment to account when nobody wants to own the output. You can challenge an engineering decision and keep the relationship, and you communicate clearly to engineers and to the Board alike.