IT Audit Manager

Responsibilities

1. Technical Audit Execution

• Perform hands-on technical audits of IT infrastructure, cloud environments, APIs, SDLC pipelines, network architecture, and wallet/custody systems.
• Conduct configuration reviews, code-level assessments, access control testing, log analysis, and system interface validation.
• Assess architecture design, security controls, and deployment pipelines against industry standards and regulatory expectations.
• Evaluate compliance with technology, cybersecurity, outsourcing, and digital-asset regulations across multiple jurisdictions.

2. Global Audit Programme Delivery

• Execute the global IT audit programme covering centralised processes (cloud infrastructure, network layer, SDLC, API gateway, identity management), adapting scope and testing for jurisdictional differences where applicable.
• Coordinate with cross-border teams and regional stakeholders to understand local regulatory requirements, operational differences, and control variations.

3. Audit Planning & Risk Assessment

• Conduct technology-risk scanning to identify emerging threats, regulatory changes, and architectural vulnerabilities across Bybit's environment.
• Perform technical walkthroughs with Engineering, Security, DevOps, and Product teams to map system architectures, data flows, and control environments.
• Contribute to the annual risk-based IT audit plan, prioritising coverage based on technical risk exposure and regulatory obligations.

4. Reporting & Remediation

• Develop well-substantiated technical findings with clear risk statements, root-cause analysis, and actionable remediation recommendations.
• Prepare concise audit reports for senior management and the Board Audit Committee.
• Track remediation progress, validate fixes at a technical level, and maintain status reporting.

5. Collaboration & Industry Awareness

• Collaborate with global IA colleagues ("One Team") to ensure consistent coverage and knowledge sharing across regions.
• Stay current on emerging technologies, cyber threats, and regulatory developments in cryptocurrency and blockchain.
• Support readiness for regulatory reviews, licensing audits, and independent assessments.

Requirements

Qualifications & Experience

• Bachelor's degree in Information Systems, Computer Science, Engineering, or related field.
• 8+ years of IT audit experience in financial services, fintech, or cryptocurrency exchange environments, with a strong technical execution focus.
• Demonstrated experience working with cross-border teams and managing stakeholder relationships across multiple jurisdictions.
• Core technical experience required:
  • IT infrastructure & network architecture (firewalls, segmentation, DNS, load balancing, VPN, zero-trust)
  • Cloud platforms (AWS, Tencent Cloud) — architecture review, IAM, security group configuration, logging & monitoring
  • API security — authentication, authorisation, rate limiting, input validation, gateway configuration
  • SDLC — secure coding practices, CI/CD pipeline controls, code review, container security, change management
• Preferred experience:
  • Digital wallet systems & crypto key management (HSM, MPC, multi-sig, cold/warm/hot wallet architecture)
  • Web3 technology & blockchain security (smart contract auditing, on-chain monitoring, consensus mechanisms, DeFi protocol risks)
• Familiarity with digital-asset regulatory frameworks (EU MiCA, UAE VARA, Türkiye, Kazakhstan, Georgia, Indonesia, Argentina) is advantageous.

Technical Skills

• Ability to read and assess system configurations, infrastructure-as-code, CI/CD pipelines, and API specifications.
• Hands-on experience with cloud security tooling (CloudTrail, GuardDuty, Azure Defender, AWS Config).
• Proficiency in log analysis, network traffic assessment, and security testing tools.
• Experience leveraging AI tools (e.g., Claude, Clawbot) and data analytics to support audit execution is preferred.

Soft Skills

• Strong analytical and problem-solving skills; able to translate technical findings into business-relevant risk language.
• Effective communicator across cultures and time zones — comfortable engaging with engineering and product teams globally.
• Self-directed; able to manage multiple concurrent audits independently in a globally distributed environment.

Certifications

• CISA, CISM, CISSP, or CRISC preferred.

Other Requirements

• High integrity, professional skepticism, and attention to detail.
• Proficiency in English and Mandarin Chinese.
• Location: Hong Kong, Abu Dhabi or Malaysia.