IT Audit Manager

About the job

Join Our Family Today.

Together, We'll Make Travel Better.

We are seeking a highly capable IT Audit professional to lead and execute risk-based IT audit activities across the Group. This role operates in a dynamic, multicultural environment and partners closely with global business and technology stakeholders to assess risk, strengthen internal controls, and support continuous improvement. Reporting to the Global Director, Internal Audit & Corporate Governance, the successful candidate will work independently across assigned business areas while contributing to the broader internal audit agenda.

What You'll Be Doing:

• Develop, maintain, and continuously enhance the Group's IT audit framework in alignment with the organisation's technology landscape, risk profile, and control environment.
• Plan, scope, and execute risk-based IT audits covering IT general controls, applications, system implementations, change management, cybersecurity, data security, and related technology processes.
• Assess the design and operating effectiveness of IT controls, identify control gaps and emerging risks, and provide practical recommendations to improve governance, efficiency, and control effectiveness.
• Lead or support internal audit engagements and IT advisory reviews, including audit planning, fieldwork, testing, documentation, reporting, and stakeholder discussions.
• Prepare clear, concise, and actionable audit reports for management, and monitor the timely implementation of agreed corrective actions through follow-up reviews.
• Collaborate with business and functional teams across the Group to promote strong control awareness, support change initiatives, and drive process improvements.
• Keep abreast of evolving technology risks, regulatory requirements, and industry best practices to strengthen audit coverage and provide relevant insights to stakeholders.

What You'll Need:

• Bachelor's degree in Information Technology, Information Systems, Accounting, Finance, Computer Science, or a related discipline.
• At least 6 years of relevant experience in internal audit, external audit, IT audit, IT risk, or a related assurance function.
• Professional certifications such as CISA, CIA, CPA, CISM, CISSP, or equivalent are preferred.
• ISO/IEC 27001 Lead Auditor certification is strongly preferred.
• Strong knowledge of IT general controls, cybersecurity risk, system implementation reviews, change management, data protection, and risk-based audit methodologies.
• Practical experience with relevant governance, risk, and compliance standards or frameworks such as GDPR, ISO 27001, COBIT, NIST, or equivalent is an advantage.
• Practical experience in cloud security audit and assessment across AWS, Azure, and Alibaba Cloud is a definite advantage.
• Solid experience on PCI DSS, ISO/IEC 27001:2022 and SOC Type 2 security audit assessment with internal stakeholders, bank, airline and external audit firms. Able to recommend Corrective Action request and remediation plan.
• Strong analytical, report-writing, and stakeholder management skills, with the ability to communicate effectively across business and technology teams.
• Fluency in English is required; proficiency in both spoken and written Chinese (Putonghua and Cantonese) is highly advantageous.
• Able to work independently in a fast-paced, multicultural environment and manage multiple priorities effectively.