Internal Auditor

Department: Risk and Compliance

Employment Type: Permanent - Full Time

Location: Pune

Reporting To: Alex Murphy

Description

Key Responsibilities

• Conduct technology, information security, cybersecurity, and compliance audits to assess the design, efficiency, and effectiveness of internal security controls.
• Lead remediation discussions with stakeholders, ensuring clear guidance and timely resolution of audit findings.
• Develop audit plans, including scope and objectives, and ensure audit assignments are completed accurately and within agreed timelines.
• Engage and collaborate with key internal stakeholders, maintaining professionalism to ensure successful delivery of audit engagements.
• Perform remote auditing activities, including assessments of physical security controls.
• Serve as an escalation point for internal audit queries, providing clarity and expert guidance.
• Produce high‑quality audit documentation, reports, and supporting evidence.
• Prepare and deliver monthly KPI/KRI reporting.
• Support the coordination and delivery of global ISO 27001 external audits.
• Share best practices and contribute to the promotion of innovation across the security function.
• Foster a culture of continual improvement across all aspects of security. Demonstrate the company’s core values: We are Dynamic, We are Innovative, We are Connected, and We Succeed Together.
• Perform additional duties as required to support the wider Information Assurance team.

Skills, Knowledge and Expertise

• Exceptional attention to detail, with strong analytical, reporting, and communication capabilities.
• Clear and confident communicator, able to translate complex security concepts into language suitable for both technical and non‑technical audiences.
• Strong stakeholder management skills with a focus on delivering an excellent customer experience.
• Proactive, self‑motivated problem solver with the ability to work independently and take initiative.
• Flexible, approachable, and effective in collaborative, fast‑paced environments.
• Results‑driven and commercially aware, with the ability to align security activities to business objectives.

• Strong understanding and practical experience with ISO/IEC 27001:2022, including both audit and implementation activities (implementation is advantageous).
• Solid knowledge of ISO 31000: Risk Management – Guidelines.
• Working knowledge of key cybersecurity frameworks such as the NIST Cybersecurity Framework (CSF) and CIS Controls.
• Familiarity with security governance and compliance practices, including the development and interpretation of policies, standards, and procedures.
• Good understanding of IT infrastructure, cloud services, business applications, and third‑party supplier risk management.
• Proficient in risk assessment methodologies, including risk identification, analysis, evaluation, and mitigation strategies.
• Strong understanding of security incident response processes, including escalation, investigation, and reporting.
• Awareness of relevant regulatory and legal requirements, including: 
• GDPR
• UK Data Protection Act
• EU AI Act
• India Digital Personal Data Protection Act (DPDPA)

• Ability to perform information security internal audits and produce clear, accurate, and well‑structured audit findings.
• Collaborative team player, comfortable working alongside cross‑functional teams including departments such as IT, Legal, HR, Risk, and Operations.
• Capable of leading small‑scale initiatives and contributing to continual improvement across security and risk audit activities.
• Quick learner with a strong growth mindset, adaptable, and able to adjust effectively to changing priorities.
• Strong understanding and practical experience with key information security and cyber risk frameworks, including ISO 27001, ISO 31000, NIST RMF/CSF, and CIS Controls.
• Proven experience in conducting audits focused on information security and risk management.
• Excellent English communication skills, both written and verbal, with the ability to convey complex information clearly and effectively.
• Relevant professional certification, including: 
• ISO/IEC 27001:2022 Lead Auditor
• A confident, collaborative team player who enjoys audit work and thrives in an environment that focuses on solutions rather than problems.