About QONA SACCO

QONA SACCO is a leading financial institution committed to providing innovative and accessible financial solutions to its members. We are dedicated to fostering economic empowerment and sustainable growth within the communities we serve.

Role Overview

We are seeking a highly skilled and experienced Information Systems Auditor to join our team. The successful candidate will be responsible for assessing and improving the effectiveness of our IT governance, risk management, and control processes. This role is crucial in ensuring the security, integrity, and availability of our information systems and data.

Key Responsibilities

• Conduct comprehensive audits of information systems, applications, and IT infrastructure to identify risks and vulnerabilities.
• Evaluate the design and effectiveness of IT controls, policies, and procedures.
• Develop and execute audit plans, programs, and methodologies.
• Assess compliance with relevant laws, regulations, and industry best practices (e.g., IT General Controls, Application Controls).
• Perform security assessments, penetration testing, and vulnerability scans.
• Review IT project management processes and system development lifecycles.
• Prepare detailed audit reports, including findings, recommendations, and management action plans.
• Follow up on audit recommendations to ensure timely and effective implementation.
• Collaborate with IT management and staff to promote a strong control environment.
• Stay updated on emerging IT trends, risks, and audit techniques.

Qualifications and Experience

• Bachelor's degree in Information Technology, Computer Science, Accounting, Finance, or a related field.
• Professional certification such as CISA (Certified Information Systems Auditor), CISSP (Certified Information Systems Security Professional), or equivalent is highly desirable.
• Minimum of 3-5 years of experience in information systems auditing, IT risk management, or IT security.
• Strong understanding of IT governance frameworks (e.g., COBIT, ITIL) and security standards (e.g., ISO 27001).
• Proficiency in auditing IT infrastructure, networks, databases, and applications.
• Experience with data analytics tools and techniques for audit purposes.
• Excellent analytical, problem-solving, and communication skills.
• Ability to work independently and as part of a team.

What We Offer

• Competitive salary and benefits package.
• Opportunities for professional development and growth.
• A dynamic and supportive work environment.

• Conduct comprehensive audits of information systems, applications, and IT infrastructure to identify risks and vulnerabilities.
• Evaluate the design and effectiveness of IT controls, policies, and procedures.
• Develop and execute audit plans, programs, and methodologies.
• Assess compliance with relevant laws, regulations, and industry best practices (e.g., IT General Controls, Application Controls).
• Perform security assessments, penetration testing, and vulnerability scans.
• Review IT project management processes and system development lifecycles.
• Prepare detailed audit reports, including findings, recommendations, and management action plans.
• Follow up on audit recommendations to ensure timely and effective implementation.
• Collaborate with IT management and staff to promote a strong control environment.
• Stay updated on emerging IT trends, risks, and audit techniques.

• Strong understanding of IT governance frameworks (e.g., COBIT, ITIL) and security standards (e.g., ISO 27001).
• Proficiency in auditing IT infrastructure, networks, databases, and applications.
• Experience with data analytics tools and techniques for audit purposes.
• Excellent analytical, problem-solving, and communication skills.
• Ability to work independently and as part of a team.

• Bachelor's degree in Information Technology, Computer Science, Accounting, Finance, or a related field.
• Professional certification such as CISA (Certified Information Systems Auditor), CISSP (Certified Information Systems Security Professional), or equivalent is highly desirable.