Vice President, IT Audit

Job description

Sumitomo Mitsui Banking Corporation (三井住友銀行) (incorporated in Japan with limited liability) is one of the major international banks and a leading arranger of specialized financial products worldwide. The Bank's Hong Kong Branch is now seeking high calibre individuals with long-term career objectives to apply for the following position: Vice President, IT Audit - Internal Audit Department, Asia Pacific - Support Job Duties & Responsibilities: Lead and/or execute audits independently and efficiently, which includes audit planning, fieldwork, reporting and, issue follow-up and closure. Conduct the audit activites in accordance with the Bank's internal audit methodology. Assess the Bank's IT and IS internal control environment with view to provide value-adding recommendations to Management to address emerging issues or remediate identified weaknesses. Support regional and global IT and Cybersecurity audit initiatives Apply data analytics to assess the internal control environment. Establish and develop good working relationships with Management of assigned IT and IS departments, for which the candidate has been assigned risk assessment responsibilities. Contribute to the annual risk assessment exercise by developing a good understanding of the business strategy, plans, products, processes, performance, risks, and issues of the assigned IT and IS departments across the region. Perform continuous monitoring on IT and IS activities across the region, to keep abreast on evolving markets, regulatory, business and operational changes to drive appropriate ongoing audit coverage. Participate in the IADAP strategic initiatives and global projects as opportunities arise. Occasional Travel is required. Requirements: University graduate with professional qualification (e.g., CISA, CPA, CIA, AIGP, AAIA etc.) Minimum 8 years’ working experience in IT/IS audits, preferably in the banking industry. IT audit knowledge in cybersecurity, application controls, IT infrastructure, IT service management, digital banking, artificial intelligence, cloud, IT process strategic planning, and system development life cycle, etc. Familiar with the regulatory requirements specific to technology risk management and cybersecurity across the Asia Pacific region (e.g. Hong Kong Monetary Authority, Monetary Authority of Singapore, etc). Good knowledge in controls and risk management of banking products (e.g., Payment, eBanking, Treasury, Corporate Banking, Structured Finance, etc.). Ability to work independently, with good interpersonal and communication skills. Exposures to global stakeholder engagement is a plus. Good planning and other project management skills and organizational skills. Proficient in both spoken and written English. Please apply with detailed resume stating latest and expected salary . SMBC is an equal opportunity employer. We are committed to fostering a diversified and inclusive workplace and removing barriers to provide equal access to employment. Note on Mandatory Reference Check ("MRC") Scheme: The MRC Scheme seeks to address the "rolling bad apples" phenomenon in the banking sector in Hong Kong, i.e. situations where individuals who engage in misconduct during their employment in one institution are able to obtain subsequent employment in another institution without disclosing their misconduct to the new employer. Against this background, the HKMA proposed a framework to facilitate Authorized Institutions ("AIs") to bilaterally obtain reference information during their recruitment process for certain positions, such that misconduct information in an individual's previous employments can be provided to AIs to inform their employment decisions. For in-scope positions, satisfactory completion of MRC process is pivotal for the consideration of employment decision. For details, you may visit HKMA's website and refer to the latest FAQs issued by HKAB . Further details will be shared on request if your application is being proceeded. Application details will be used only for recruitment purposes, and will be destroyed after 1 year. Applicants not contacted after 6 weeks may consider their applications unsuccessful.