Job Summary
The Group Internal Audit & Investigations (GIAI) at Standard Chartered Bank is seeking a strong Senior Audit Manager to join the Information and Cyber Security (ICS) team. The role requires solid technical expertise across identity and access management, vulnerability management, code security, security operations, threat intelligence, red and purple teaming, penetration testing, and ICS standards such as NIST and CIS, along with risk management experience. Exposure to AI security and digital assets is highly desirable.
Key Responsibilities
Strategy
• Support the HOA in the development of the GIA risk assessment and development of an appropriate audit plan for the assigned portfolio;
• Propose audits for coverage during the audit cycle based on their knowledge of the business;
• Carry out their role in line with the Audit Charter and remain independent from management and free from interference; and
• Provide clear, effective supervision and leadership to the audit teams and champion the implementation of the strategy.
Business
• Perform, support, or lead where directed, the planning, fieldwork, and reporting of internal audit engagements to deliver agreed assurance objectives to established GIA standards and timelines; and
• Deliver audits/assignments within budget and drive efficiency to support cost save objectives;
Processes
• Act as Team Manager or Team Lead to lead the delivery of high risk audits with integrated teams;
• Execute audit work and issue validation in an efficient and effective manner, within the given budget and timelines;
• Provide clear guidance, detailed review and supervision of the audit team’s work, so that audit deliverables meet quality standards;
• Clearly identify the risks and impact of issues during issue writing, agreeing these issues with management and obtaining quality management action plans to mitigate the risk;
• Provide guidance to the team on business/ audit technical knowledge and management skills;
• Champion innovation and increase the use of leading edge methods, such as artificial intelligence and data analytics, in audit assignments; and
• Track the implementation/delivery of the agreed issues and action plans for the audits assigned, understanding the key risks arising, provide advice on resolution of issues to auditees/action plan owners and escalate audit findings that remain unresolved.
People and Talent
• Share knowledge, skills and experience with team members and the wider GIA and provide advisory to internal auditors from both business and technology on Information and Cyber Security;
• Assist in conducting training sessions for GIA Stakeholders on topics related to Information and Cyber Security;
• Support the function in audit talent development and career growth;
• Develop skills and competencies to support the function in ensuring future readiness; and
• Contribute to building a high performing collaborative function through regular feedback and coaching;
Risk Management
• Complete relevant risk assessment activities in a timely and effective manner, including the completion of the Risk Assessment template;
• Assist in continuous auditing and monitoring of key risks in Information and Cyber Security; and
• Follow changes in the laws and regulations to identify emerging risks.
Governance
• Assist the HOA to manage the relevant Product/Country clients, and establish good working relationships to help the businesses improve the control environment and keep updated with changes in the business impacting their risk profile;
• Ensure clear communication of findings/issues/root causes to all relevant clients and monitor/escalate any overdue actions plans to the appropriate business manager and/or governance committee for resolution; and
• Ensure timely escalation of delays in execution of audit work, both to auditee management and GIA management.
Regulatory and Business Conduct
• Display exemplary conduct and live by the Group’s Values and Code of Conduct;
• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct; and
• Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.
Key Stakeholders
• Designated business stakeholders, typically related to individual audit assignments and the Information and Cyber Security portfolio; and
• GIA stakeholders – team leaders, team members, team managers, Product, Functional, Country and Regional Heads of Audit.
Other Responsibilities
• Embed Here for good and Group’s brand and values in GIA; and
• Perform other responsibilities assigned under Group, Country, Business or Functional policies and procedures.
Skills and Experience
Technical and Audit Skills:
• Strong understanding of identity and access management, vulnerability management, code security, security operation centre, threat intelligence, red and purple teaming, penetration testing, ICS related industry standards such as NIST and CIS, and risk management.
• IT infrastructure components, including servers, networks, databases, and cloud services would be a plus.
• Knowledge of cybersecurity principles, frameworks, and best practices.
• Proficiency in audit tools and techniques.
Professional Certifications:
• Professional certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Cloud Security Professional (CCSP), and Global Information Assurance Certification (GIAC) related certificates are highly desirable. Other designations such as Certified in Risk and Information Systems Control (CRISC) and Certified Information Security Manager (CISM), and Certified Internal Auditor (CIA) are a plus.
Analytical Skills:
• Excellent analytical and problem-solving abilities with a keen attention to detail.
Soft Skills:
• Communication Skills: Strong written and verbal communication skills to effectively convey audit findings and recommendations.
• Interpersonal Skills: Ability to work collaboratively with cross-functional teams and build strong relationships with stakeholders.
• Group Information and Cyber Security Risk
• Information and Cyber Security domain knowledge (e.g. Identity and Access Management, Third Party Risk Management)
• Audit
• Risk and Controls
• Business Language (Written/Spoken)
• Microsoft Word/Excel/PowerPoint
Our Ideal Candidate
• 12 years of experience in IT auditing, information security, or risk management.
• In-depth understanding of Information and Cyber Security risk management and associated control requirements;
• Strong communicator, both written and verbal, with ability to clearly explain complicated technical issues in business terms to audit and business management;
• Team management, team leading, coaching and mentoring, problem solving and conflict management, multi-tasking, risk assessment and collaboration.
• Strong understanding of identity and access management, vulnerability management, code security, security operation centre, threat intelligence, red and purple teaming, penetration testing, ICS related industry standards such as NIST and CIS, and risk management.
• IT infrastructure components, including servers, networks, databases, and cloud services would be a plus.
• Knowledge of cybersecurity principles, frameworks, and best practices.
• Proficiency in audit tools and techniques.
• Professional certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Cloud Security Professional (CCSP), and Global Information Assurance Certification (GIAC) related certificates are highly desirable. Other designations such as Certified in Risk and Information Systems Control (CRISC) and Certified Information Security Manager (CISM), and Certified Internal Auditor (CIA) are a plus.
• Excellent analytical and problem-solving abilities with a keen attention to detail
• Bachelor’s degree in information technology, Computer Science, Information Systems, or a related field. A master's degree is a plus.
Role Specific Technical Competencies
• Group Information and Cyber Security Risk
• Information and Cyber Security domain knowledge (e.g. Identity and Access Management, Third Party Risk Management)
• Audit
About Standard Chartered
We're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we want to hear from you. You can count on us to celebrate your unique talents and we can't wait to see the talents you can bring us.
Our purpose, to drive commerce and prosperity through our unique diversity, together with our brand promise, to be here for good are achieved by how we each live our valued behaviours. When you work with us, you'll see how we value difference and advocate inclusion.
Together we:
• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do
• Never settle, continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well
• Are better together, we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term
What we offer
In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.
• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.
• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.
Recruitment Assessments
Some of our roles use assessments to help us understand how suitable you are for the role you've applied to. If you are invited to take an assessment, this is great news. It means your application has progressed to an important stage of our recruitment process.
Visit our careers website www.sc.com/careers
