Senior Technology Risk

About the role

EY is looking for a highly motivated Senior Technology Risk to join its IT Audit team in Luxembourg. You will contribute to IT audit engagements locally and abroad, supporting financial audits through IT-related work and delivering advisory services in cybersecurity, IT strategy, business continuity and regulatory compliance.

Key responsibilities

• Support financial statement audits by evaluating clients' IT control environments and developing solutions
• Act as a stream leader on business consultancy engagements in cybersecurity, IT risk management and business continuity
• Analyse client IT environments, identify risks and evaluate controls
• Review segregation of duties and sensitive access in application systems to assess conflicts in financial reporting
• Design and run IT audits, including systems development, conversion and application control reviews
• Perform in-depth control assessments, document test requirements and suggest remediation alternatives
• Use technology-based tools to review, design and implement products and services

Required profile

• Master's degree or equivalent certification in Computer Science, Information Systems, Engineering or a related field
• At least 2 years as an IT auditor (internal or external) or 3 years as an IT consultant
• Fluent French and English; additional languages are an asset
• Experience in IT risk management and internal control
• Ideally: experience in financial or operational audits, ISMS implementation, business continuity, ERP security reviews (Oracle, SAP, MS Dynamics), and general computer controls

Required skills

• Knowledge of IT frameworks such as ITIL, COBIT, ISO 27001, ISO 22301 and CMMI
• Familiarity with data protection and governance regulations (EU GDPR, DORA, NIS2)
• CISA certification or willingness to obtain it within one year of hire
• Hands-on experience with operating systems, DBMS or network administration
• Prior project planning and management experience and additional certifications such as CISM, CGEIT, CRISC, CISSP, CIA, PMP or ISO lead auditor are a plus