Executive Audit Manager, Information Technology

Role overview

This position leads independent assurance work over the bank’s technology and cyber security landscape. The role is responsible for assessing whether controls, governance, risk management, and operational practices are effective and efficient, and for reporting findings to the IT Audit Director.

The role also supports the development, administration, and delivery of the internal audit plan for ARB’s IT, cyber security, and business-managed platform technology teams. Coverage includes ARB subsidiaries in Saudi Arabia and abroad, such as Kuwait, Jordan, Malaysia, Emkan, Ejada, NewLeap, and Tawtheeq, along with managed affiliates.

When needed, the role helps the IT Audit Director and CIA respond to external auditors and Saudi regulators, including SAMA and NCA. This includes tracking internal audit responses to regulators and validating regulatory matters.

Key responsibilities

• Contribute as a senior member of Internal Audit to shaping and executing the IT audit strategy and annual plan in line with departmental and business priorities.
• Individually or with a team, perform IT audits according to the ARB audit framework, IIA standards, and internal departmental procedures.
• Lead or participate in audits and reviews covering IT systems, applications, cyber security, and related technology processes.
• Prepare audit outcomes and present them to senior executives and audit committees.
• Conduct cyber security reviews and maturity assessments of security processes and controls.
• Carry out IT audits across areas such as networks, operating systems, and data centers, including review of how cyber risks are identified and mitigated.
• Assess the technology control environment and provide recommendations on control effectiveness and risk reduction.
• Review policies and procedures related to change management, business continuity, disaster recovery, and information security to confirm controls are adequate.
• Recommend corrective actions for control gaps and track remediation until significant deficiencies are addressed.
• Help IT and cyber security teams build action plans and ensure remediation is completed on time.
• Develop detailed audit plans by identifying key risks and controls, defining audit objectives, and building suitable audit programs.
• Draft audit reports with limited supervision for management and the Board Audit Committee, including objective conclusions and management’s corrective actions.
• Lead annual audit planning and risk assessment activities for IT and cyber security, including coordination with other audit groups where required.
• Use knowledge of the current technology landscape and industry trends to identify emerging risks and issues.
• Drive the creation and execution of a risk-based audit plan aligned to management goals and Board Audit Committee requirements.
• Monitor progress of planned audits and special assignments to ensure timely delivery.
• Maintain quality assurance standards throughout the IT audit lifecycle and contribute to improvements where quality concerns are identified.
• Build strong working relationships with staff and management through regular individual and group interaction.
• Support people management activities by helping define team and individual goals, managing performance, coaching staff, and providing both formal and informal feedback.

Qualifications and experience

• A bachelor’s degree in information systems is required.
• Professional certifications are preferred, including CISA, CISM, CGEIT, CRISC, or CIA.
• Strong familiarity with banking technology and financial services risk areas is expected.

Knowledge and technical focus

• Understanding of cloud technologies, IT operations, data center services, storage and databases, server virtualization, cyber security operations, data privacy, data protection, cryptography, and data loss prevention.

Additional information

This role is based in Riyadh, Saudi Arabia and is a full-time, on-site position. No salary, stipend, vacancy count, start date, or application deadline was provided in the source.