IT Analyst (Risk)
PRIMARY RESPONSIBILITIES:
3. In close coordination with IT Assurance Team, the Sr. IT Controls Analyst will
perform the following:
Perform Pre-implementation IT controls review:
• Review IT general controls of IT systems going live as part of the Security
License to Operate (SLTO) process and identify potential control gaps and risks
• Review project documents for compliance to the IT Project Management
Framework (PMF) and provide recommendations to address potential gaps
• Coordinate with project teams to address gaps identified during the pre-
implementation review
Support IT Policy Development and Maintenance:
• Maintain central repository for ITD policies, processes, and standards
• Facilitate periodic review of ITD policies, processes, and standards for required
updates
• Develop and/or update comprehensive ITD policies, processes and standards
that align with industry good practices and frameworks, and in coordination with
relevant stakeholders
• Provide recommendations for streamlining existing documentation or creation
of new policies/processes based on changes to the IT environment
Manage and maintain ITD’s GRC Tool:
• Assist in identifying user requirements and functionalities to enhance GRC tool
• Participate in testing and deployment of new functionalities or upgrades
• Configure and/or update GRC dashboards for management reporting
• Address GRC tool issues identified or reported by users
Terms of Reference
Office of Information Systems and Technology
TOR - Senior IT Analyst (IT Controls)_May2024 (1)1 2
appropriate permission.
Other IT risk and compliance activities:
o Support IT risk assessments and IT policy exception requests
o Assist in coordination of audit and compliance requirements
o Other activities as may be required
QUALIFICATIONS:
• Bachelor’s degree, preferably in Business Administration/Management,
Accounting, Computer Science, Information Technology or Engineering
• Minimum of 5 years relevant work experience in IT audits, application
development controls review and IT policy development
• Experience working in audit firm either locally or abroad
• Knowledgeable on frameworks such as Sarbanes-Oxley, COSO, COBIT,
NIST, PMBOK, ISO 27001, SWIFT CSCF
• Experience in GRC tool implementation and/or administration
• CISA, CISM, CISSP, ISO 27001 certification preferred
• Good understanding of IT audit principles, standards and procedures
• Broad range of knowledge of information technology as applied in an
enterprise environment
• Must be able to relate and comfortable in dealing with senior executives
from a variety of culture
• Excellent written and oral English communication skills
• Strong analytical skills
• Willing to work in a team, with long hours while under pressure
• Attentive to details and methodical with work