IT Audit Specialist

About the role

Deriv is hiring an IT Audit Specialist in Cyberjaya, Malaysia, for a full-time, hands-on individual contributor role focused on technology and cybersecurity assurance. The specialist delivers independent, evidence-led IT audit work that strengthens the security, reliability and governance of the technology supporting Deriv's international business, examining technical controls, analysing system evidence and investigating weaknesses.

Key responsibilities

• Plan IT audit work, support risk assessments, walkthroughs and the development of audit scope, objectives and testing programmes.
• Test technology and cybersecurity controls, including identity and privileged access management, infrastructure and network security, vulnerability management, security monitoring, incident response and third-party controls.
• Review cloud and engineering practices, including cloud configurations, secure development, CI/CD pipelines, change management, application security and secrets management.
• Assess application and data controls, automated business controls, interfaces, data integrity and protection, and controls for AI-enabled systems.
• Evaluate technology resilience, including backup and recovery, disaster recovery testing and service availability.
• Analyse technical evidence such as configurations, access records, logs, change histories and test results, and investigate exceptions.
• Document findings in clear working papers and validate remediation by reviewing closure evidence and retesting controls.
• Work with engineering, security and technology teams while maintaining independence, confidentiality and professional scepticism.
• Use analytics, scripts, automation and responsibly governed AI tools to improve testing, and senior specialists lead workstreams and support less-experienced auditors.

Required profile

• Relevant IT audit or technology assurance experience, ideally in regulated financial services, fintech or another technology-intensive environment.
• Experience testing IT controls, assessing technical evidence and documenting audit conclusions.
• A relevant degree in information systems, computer science, cybersecurity or a related discipline.
• CISA, CIA or an equivalent audit qualification preferred.
• Demonstrated interest in and practical use of data analysis, scripting, automation or AI, with confidentiality safeguards.
• Excellent written and spoken English.

Required skills

• Working knowledge of cloud environments, infrastructure, cybersecurity, identity and access management, software development, application controls and technology resilience.
• Risk-based auditing, the IIA Global Internal Audit Standards and ISACA IT audit guidance, with familiarity with COBIT, NIST and ISO/IEC 27001.
• Ability to turn technology risks and regulatory requirements into practical audit tests and explain technical weaknesses in business terms.