IT Risk & Cybersecurity Consultant / Senior Consultant

Job Description IT Risk & Cybersecurity Consultant / Senior Consultant Location: Kuwait Department: Risk Consulting – IT Risk & Advisory Employment Type: Full-Time About the Opportunity As part of the continued expansion of our Risk Consulting and IT Advisory practice, PKF Kuwait is seeking a qualified and experienced IT Risk & Cybersecurity Consultant / Senior Consultant to join our consulting team. The successful candidate will be involved in delivering IT audit, cybersecurity, technology risk management, regulatory compliance and IT governance engagements across financial institutions and other industry sectors. The role offers an opportunity to work on diverse consulting assignments, evaluate complex IT environments and contribute to strengthening clients' technology governance, risk management and internal control frameworks. Key Responsibilities 1. IT Audit and Technology Risk Assurance • Execute risk-based IT internal audit and technology risk assessment engagements. • Assess IT General Controls (ITGC), including access management, change management, IT operations, system security, backup and recovery controls. • Evaluate IT governance frameworks, technology risk management practices, IT policies and procedures, and internal control environments. • Review application controls, IT infrastructure, system configurations and technology-related business processes. • Review business continuity, disaster recovery, third-party technology risks and outsourcing arrangements. • Identify control deficiencies, assess associated risks and recommend practical improvements. 2. Cybersecurity and Information Security Assessments • Conduct cybersecurity risk assessments, information security reviews and control effectiveness evaluations. • Assess information security governance, identity and access management, vulnerability management, incident response, security monitoring and data protection controls. • Evaluate cybersecurity policies, procedures and technical safeguards against recognized industry standards and regulatory requirements. • Review business continuity management, disaster recovery arrangements and operational resilience capabilities. • Assess third-party technology risks, outsourcing arrangements and vendor security management practices. 3. Regulatory Compliance and Framework Assessments • Execute IT regulatory compliance reviews and gap assessments for financial institutions and other regulated entities. • Assess the adequacy and effectiveness of technology controls against applicable regulatory requirements and industry frameworks. • Perform control design and operating effectiveness assessments through walkthroughs, stakeholder interviews, documentation reviews and evidence-based testing. • Lead end-to-end audits to ensure continuous alignment with local CBK regulatory frameworks and global relevant frameworks and standards, including ISO/IEC 27001, NIST, COBIT, SOC 2 and other applicable technology governance and cybersecurity requirements. • Support regulatory readiness assessments, compliance reviews and remediation validation engagements. 4. Engagement Execution and Reporting • Develop risk and control matrices, audit programs, assessment checklists and detailed testing procedures. • Conduct client walkthroughs, interviews and technical control assessments. • Review technical documentation, system-generated reports, configurations and other supporting evidence. • Prepare comprehensive working papers, gap analysis reports, audit observations and recommendations. • Draft professional reports and presentations communicating key findings, associated risks and recommended corrective actions. • Coordinate with client stakeholders and internal engagement teams to ensure timely completion of assignments. • 5. Practice Development and Technical Support • Contribute to the enhancement of IT audit methodologies, assessment tools, working papers and reporting templates. • Support technical scoping, engagement planning and proposal preparation. • Stay updated on emerging cybersecurity risks, regulatory developments and technology governance standards. • Collaborate with multidisciplinary consulting teams in delivering integrated risk advisory engagements. Qualifications and Experience • Bachelor's degree in Information Technology, Computer Science, Information Systems, Cybersecurity or a related field. • Minimum of 5+ years of relevant professional experience in IT audit, information security, cybersecurity, cyber resilience, technology risk management, IT advisory or related consulting services. • Experience in professional services firms, consulting organizations, financial institutions or regulated industries is preferred. • Possess relevant professional certifications such as CISA, CISM, CISSP, CRISC or ISO/IEC 27001 Lead Auditor. • Experience in executing IT audit and cybersecurity assessments, including control testing and reporting. • Familiarity with regulatory compliance requirements applicable to financial institutions is desirable. • Technical Competencies • IT governance, risk management and internal control frameworks. • ITGC and application control assessments. • Cybersecurity risk and information security control assessments. • Network, infrastructure, operating system and database security controls. • Identity and access management, vulnerability management and incident response. • Business continuity, disaster recovery and operational resilience. • Third-party technology risk and outsourcing controls. • ISO/IEC 27001, NIST, COBIT and related technology risk frameworks. • Audit documentation, risk assessment methodologies and professional reporting. Key Skills and Attributes • Strong analytical, problem-solving and technical assessment capabilities. • Ability to independently execute assigned engagements with appropriate supervision. • Excellent written and verbal communication skills. • Strong documentation and professional report-writing capabilities. • Ability to manage multiple assignments and meet engagement deadlines. • Effective stakeholder management and teamwork. • High standards of professional ethics, confidentiality and quality. Show more

Bachelor's degree in Information Technology, Computer Science, Information Systems, Cybersecurity or a related field. Minimum of 5+ years of relevant professional experience in IT audit, information security, cybersecurity, cyber resilience, technology risk management, IT advisory or related consulting services. Experience in professional services firms, consulting organizations, financial institutions or regulated industries is preferred. Possess relevant professional certifications such as CISA, CISM, CISSP, CRISC or ISO/IEC 27001 Lead Auditor. Experience in executing IT audit and cybersecurity assessments, including control testing and reporting. Familiarity with regulatory compliance requirements applicable to financial institutions is desirable.

1) IT Audit and Technology Risk Assurance: Execute risk-based IT internal audit and technology risk assessment engagements; assess IT General Controls (ITGC), including access management, change management, IT operations, system security, backup and recovery controls; evaluate IT governance frameworks, technology risk management practices, IT policies and procedures, and internal control environments; review application controls, IT infrastructure, system configurations and technology-related business processes; review business continuity, disaster recovery, third-party technology risks and outsourcing arrangements; identify control deficiencies, assess associated risks and recommend practical improvements. 2) Cybersecurity and Information Security Assessments: Conduct cybersecurity risk assessments, information security reviews and control effectiveness evaluations; assess information security governance, identity and access management, vulnerability management, incident response, security monitoring and data protection controls; evaluate cybersecurity policies, procedures and technical safeguards against recognized industry standards and regulatory requirements; review business continuity management, disaster recovery arrangements and operational resilience capabilities; assess third-party technology risks, outsourcing arrangements and vendor security management practices. 3) Regulatory Compliance and Framework Assessments: Execute IT regulatory compliance reviews and gap assessments for financial institutions and other regulated entities; assess the adequacy and effectiveness of technology controls against applicable regulatory requirements and industry frameworks; perform control design and operating effectiveness assessments through walkthroughs, stakeholder interviews, documentation reviews and evidence-based testing; lead end-to-end audits to ensure continuous alignment with local CBK regulatory frameworks and global relevant frameworks and standards, including ISO/IEC 27001, NIST, COBIT, SOC 2 and other applicable technology governance and cybersecurity requirements; support regulatory readiness assessments, compliance reviews and remediation validation engagements. 4) Engagement Execution and Reporting: Develop risk and control matrices, audit programs, assessment checklists and detailed testing procedures; conduct client walkthroughs, interviews and technical control assessments; review technical documentation, system-generated reports, configurations and other supporting evidence; prepare comprehensive working papers, gap analysis reports, audit observations and recommendations; draft professional reports and presentations communicating key findings, associated risks and recommended corrective actions; coordinate with client stakeholders and internal engagement teams to ensure timely completion of assignments. 5) Practice Development and Technical Support: Contribute to the enhancement of IT audit methodologies, assessment tools, working papers and reporting templates; support technical scoping, engagement planning and proposal preparation; stay updated on emerging cybersecurity risks, regulatory developments and technology governance standards; collaborate with multidisciplinary consulting teams in delivering integrated risk advisory engagements.