<img id="photoDetail" style="width:1250.0px;height:301.0px" src="https://www.discovery.co.za/gallery/template-resources/banners/general/smartpeople-recruit.jpg">About Discovery Discovery’s core purpose is to make people healthier and to enhance and protect their lives. We seek out and invest in exceptional individuals who understand and support our core purpose, and whose own values align with those of Discovery. Our fast-paced and dynamic environment enables smart, self-driven people to be their best. As global thought leaders, Discovery is passionate about innovating in order to not only achieve financial success, but to ignite positive and meaningful change within our society. About Discovery Bank Discovery Bank is a bank like no other – a shared-value bank, designed with our clients in mind. We’re all about sharing the value that clients create when they manage their money well, back with them through exceptional interest rates and rewards. Our Vitality Money programme measures how well clients manage their finances, informs them of what it means to be financially healthy, and empowers them with the knowledge to get enhanced rewards for managing their money well. If you’re adaptable, a problem-solver, always questioning the way things are done, passionate about doing what is right, and obsessed with providing a quality service experience, we have a job for you where you can be your best in an environment that’s safe and nurturing. Job Purpose Lead risk-based IT audits across infrastructure, cloud, cybersecurity, data, payments, and digital channels to provide independent assurance over technology risks and controls. Strengthen the bank’s control environment, meet local regulatory expectations, and enable secure innovation at speed. Areas of responsibility may include but are not limited to: 1) Audit Planning & Governance <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Develop and maintain the risk-based IT audit plan aligned to the bank’s strategic objectives, risk appetite, and Three Lines Model. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Perform technology risk assessments covering cloud (IaaS/PaaS/SaaS), cybersecurity, data & AI/ML, DevSecOps, third party risk, payments, open banking/APIs, and resilience. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Ensure conformance with the International Standards for the Professional Practice of Internal Auditing (IIA Standards / IPPF) and alignment to King IV™ principles on governance. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Prepare Audit Committee packs for IT audit coverage, opinions, key themes, and trend analyses. </li> </ul> 2) Execution of IT Audits - Lead end to end audits (scoping, fieldwork, issue validation, reporting) over: <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">IT General Controls (ITGCs) and application controls across core banking, digital channels, and enablement platforms. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Cybersecurity (governance, identity & access, SOC, vulnerability/patch, incident response, endpoint, network & cloud security). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Cloud & platform engineering (architecture, configuration, CSP shared responsibility, IaC controls, container/Kubernetes security). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Data governance & privacy (POPIA, data lineage/quality, access, ISO/IEC 27701 alignment). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Payments & cards (EFT, RTGS, card acquiring/issuing, PCI DSS scope and interfaces). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Business continuity & operational resilience (BCP/DR, RTO/RPO, scenario testing). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Third party & fintech partnerships (onboarding due diligence, contracting, ongoing monitoring, exit plans). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Change, SDLC & DevSecOps (agile ceremonies, CI/CD, testing, segregation of duties, release management). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">AI/ML & model risk (data sourcing, bias, explainability, monitoring, access, change control—coordinating with Model Risk/Internal Audit specialists). </li> </ul> 3) Issue Management & Stakeholder Engagement <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 0.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif"> </li> </ul> <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Produce clear, prioritized reports with root cause, business impact, and actionable remediation:</li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Track and validate remediation; escalate overdue/high risk issues. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Build strong relationships with CIO/CTO/CISO, Data, Engineering, Product, Risk, and Compliance while maintaining independence. </li> </ul> 4) Data Led Assurance & Continuous Auditing <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Drive data analytics in audits (e.g., log analysis, user access analytics, config drift, control health dashboards). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Pilot continuous monitoring and controls automation where feasible; mentor the team on Python/SQL/Power BI usage. </li> </ul> 5) Regulatory and Standards Alignment <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Align assurance to Banks Act requirements and Prudential Authority (SARB) expectations, POPIA, FICA, NCA, and Payment System rules where applicable. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Reference and benchmark against COBIT, NIST CSF/800 53, ISO/IEC 27001/2, PCI DSS, CIS Controls, and internal policies/standards. </li> </ul> 6) People, Quality & Vendor Management <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Manage, coach, and upskill the audit team; curate an annual training plan (CISA/CISM/CISSP, cloud security, data analytics). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Oversee co-sourced audit partners; set scope, quality criteria, and deliverable timelines. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Perform engagement quality reviews and maintain a robust internal audit Methodology & QAIP (Quality Assurance and Improvement Program).</li> </ul> Personal Attributes and Skills <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Risk based, outcome oriented thinker with strong professional skepticism and independence. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Executive presence & communication: able to distill complex tech risks into concise messages for EXCO/Audit Committee. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Collaboration & influence: builds trust with Technology and Product while holding firm on control requirements. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Learning agility: keeps pace with cloud native architectures, platform engineering, AI/ML, and evolving threats. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Structured problem solver with strong root cause and issue prioritisation skills. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Ethical judgement and confidentiality aligned to IIA Code of Ethics. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Resilience under pressure; comfortable challenging senior stakeholders. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Excellent writing (findings, opinions, and board level reporting).</li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Banks Act and SARB Prudential Authority supervisory expectations (incl. IT/cyber risk, outsourcing, operational resilience). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">POPIA, FICA, NCA, Payments Association of SA rules, and relevant PCI DSS obligations. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Corporate governance via King V™ and alignment to the IIA Standards (IPPF). </li> </ul> Education and Experience <ul style="margin-bottom:8.25pt;margin-top:0.0px"> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Bachelor’s degree in Information Systems, Computer Science, Engineering, Risk/Audit, or related field (required). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Professional certifications (one or more required): CISA (preferred), CIA (advantage), CISM/CRISC/CISSP, ISO 27001 Lead Auditor/Implementer (advantage). </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Cloud security certifications (e.g., CCSP, AWS/Azure security specialty) advantageous. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Data & analytics: demonstrable SQL and/or Python skills; data privacy certification (e.g., CIPT) advantageous.</li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">8–10+ years total experience in IT audit, technology risk, cybersecurity, or related assurance</li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">3–5+ years in a managerial/lead role. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Banking/fintech background essential; digital retail bank experience strongly preferred. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Led multiple audits across cloud, cybersecurity, digital channels, payments, core banking, data governance, and third‑party risk. </li> <li style="margin:0.0in 0.0in 8.25pt 48.0px;line-height:115%;background-color:white;font-size:11.0pt;font-family:Calibri, sans-serif">Experience interfacing with Audit Committees, regulators, and external auditors. </li> </ul> EMPLOYMENT EQUITY The Company’s approved Employment Equity Plan and Targets will be considered as part of the recruitment process. As an Equal Opportunities employer, we actively encourage and welcome people with various disabilities to apply.

Internal Audit Manager (Sandton - 1 Discovery Place, GP, ZA, 2196) @ Discovery

About this role

Ready to apply?