> Markdown version of [/jobs/ext/3016705-internal-audit-manager-it-information-security](https://www.wearedevelopers.com/jobs/ext/3016705-internal-audit-manager-it-information-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Internal Audit Manager - IT & Information Security

- **Company:** Ebury Madrid
- **Location:** Spain (Remote available)
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Big Data, Software as a Service, Cloud Computing, Cloud Engineering, Control Objectives for Information and Related Technology (COBIT), Cyber Security, Information Systems, Continuous Integration, Data Governance, Digital Architecture, Identity and Access Management, Information Technology Audit, Network Security, PCI Data Security Standards, Security Information and Event Management, File Transfer Protocol (FTP), IT General Controls (ITGC), Delivery Pipeline, Software Security, Containerization, Information Technology, Data Lineage, Data Management, Cyber Warfare, Splunk, Api Management, Microservices
- **Published:** September 20, 2026
- **Apply:** https://startup.jobs/senior-internal-audit-manager-it-information-security-ebury-10126573

## About the Role

5+ years in IT/Cyber Audit within cloud-native Fintech platforms, financial institutions, or Big 4 tech practice.

Core Credentials

CISA, CISSP, CISM, or CRISC required; dual ACA/CIA qualification preferred.

Technical Stack

Cloud Infrastructure (AWS), Identity & Access Management, SIEM/SOC (Splunk, CrowdStrike, ReliaQuest), GRC (AuditBoard).

Regulatory Knowledge

DORA, FCA PS21/3, PRA Operational Resilience, ISO 27001, COBIT, NIST framework, and related.

Domain Focus

Payments lifecycle, treasury automation platforms, API security, third-party/BPO risk management., * Min 5 years experience auditing cloud-native digital architecture (microservices, containerization, API integrations).

 * Track record of building or executing an annual IT risk assessment and audit plan within an engineering-driven or fast-paced Fintech environment.
 * Proven capability in evaluating end-to-end payment processing controls (authorisation, clearing, settlement, reconciliation).

Certifications

 * Certified Information Systems Auditor (CISA)
 * Certified Information Systems Security Professional (CISSP)
 * Certified Internal Auditor (CIA) (highly advantageous)

Skills & Competencies

 * Ability to translate complex cybersecurity and technical risks into clear, business-focused insights for non-technical executives.
 * Pragmatic approach to control framework design, balancing rapid product innovation with regulatory compliance and robust risk management.
 * Strong collaborative mindset with experience in mentoring junior auditors and managing external co-source resource partners.

## Description

The Senior Audit Manager - IT & Information Security is a technology risk expert responsible for evaluating and enhancing the internal control environment across cloud infrastructure, cyber security controls, third-party ecosystems, and engineering platforms used in the SDLC. This candidate combines deep technical expertise in cloud security and DevSecOps with financial technology regulations (e.g., DORA, FCA PS21/3, PRA Operational Resilience, ISO 27001)., The Senior Audit Manager - IT & Information Security leads the design, execution, and delivery of the annual IT Audit Plan. Reporting to the Group Head of Internal Audit, the role provides independent assurance to executive stakeholders (CIO, CISO, COO, CRO, DPO) and the Audit Committee regarding platform resilience, cybersecurity maturity, data protection, and adherence to evolving international regulatory standards., * Lead risk-based audits covering cloud infrastructure (AWS), network security, Identity & Access Management (IAM), privileged access, and containerized deployment environments.

 * Assess operational effectiveness of Cyber Defense controls, including SOC monitoring, Incident Response, SIEM integration (Splunk), and EDR deployments (CrowdStrike).
 * Perform audits of IT General Controls (ITGCs) and automated application controls (ITACs) integrated into CI/CD deployment pipelines.

Third-Party Risk & Platform Operations

 * Evaluate third-party vendor risk management frameworks, conducting hosted assurance reviews for critical SaaS platforms.
 * Oversee control assurance frameworks for third-party partnerships, ensuring compliance with DORA and FCA PS21/3 operational resilience guidelines.

Regulatory Alignment & Compliance

 * Assess readiness and operational adherence to key regulatory regimes, including DORA, PRA Operational Resilience, SWIFT Customer Security Programme (CSP), and ECCTA/FTP regulations.
 * Conduct gap analyses and pre-assessment audits against ISO 27001 and PCI DSS standards.

Data management and privacy

 * Evaluate data governance frameworks, data lineage, and data quality controls across enterprise analytics and reporting platforms.
 * Audit data protection and privacy policies and mechanisms (such as GDPR/CCPA) applied within large-scale data storage and analytics environments.

Stakeholder Management & Governance

 * Maintain strong relationships with technical stakeholders, including the CISO, Head of Engineering, CIO, and Chief Data Officer.
 * Formulate pragmatic, risk-ranked audit findings and present formal audit reports to Executive Committees and Board Audit Committees., Ebury only accepts applications via official Ebury channels. We will only contact you from an @ebury.com domain. Always check the emails you receive from us, and note that we will never request payment for any part of the recruitment process. Stay safe and report suspicious activity.
Notice to Recruitment Agencies and Search Firms:
Ebury does not accept unsolicited resumes, CVs, or candidate profiles from recruitment agencies or search firms without signed written Ebury recruitment terms in place for a specific role. Any unsolicited applications will be considered the sole property of Ebury. Ebury will not be responsible or liable for any placement fees or costs associated with unagreed candidate submissions or subsequent hires.
AI Transparency Statement:
Ebury uses Artificial Intelligence (AI) and automated tools to help streamline certain parts of our recruitment process, however, these tools are strictly for administrative efficiency. All hiring decisions, including application reviews, shortlisting, and final selections are evaluated and conducted by human talent acquisition professionals and hiring managers.


## Related Videos

- [Alibaba Big Data and Machine Learning Technology](https://www.wearedevelopers.com/videos/37-alibaba-big-data-and-machine-learning-technology)
- [Inside Bitpanda's Tech Stack: Scaling a European Fintech Leader - Markus Dorner](https://www.wearedevelopers.com/videos/1979-inside-bitpanda-s-tech-stack-scaling-a-european-fintech-leader-markus-dorner)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Enjoying SQL data pipelines with dbt](https://www.wearedevelopers.com/videos/823-enjoying-sql-data-pipelines-with-dbt)
- [The New Financial Stack: AI, Agents and Trust](https://www.wearedevelopers.com/videos/100002-the-new-financial-stack-ai-agents-and-trust)
- [The Future of Recruiting: Innovations and Challenges in the European IT Sector](https://www.wearedevelopers.com/videos/1056-the-future-of-recruiting-innovations-and-challenges-in-the-european-it-sector)

## Related Articles

- [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries)
- [Spanish Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/353-spanish-business-culture-and-etiquette)
- [The Biggest German Tech Companies](https://www.wearedevelopers.com/magazine/424-the-biggest-german-tech-companies)
- [Find a Developer Job: 12 Best Job Sites For Developers](https://www.wearedevelopers.com/magazine/165-find-a-developer-job-12-best-job-sites-for-developers)