IT Audit Manager

About Us

1. Responsibilities

1. EU Technology Audit Delivery

   • Lead and execute risk-based IT audits across EU operations, covering key technology, cybersecurity, ICT risk, operational resilience, data protection, and third-party risk areas.
   • Assess the design and effectiveness of ICT governance and controls against applicable EU regulatory requirements, including DORA and related RTS/delegated regulations, MiCA, MiFID II, EMI/payment services requirements, GDPR, NIS2, and relevant EBA guidelines.
   • Work closely with the Global IT Audit team on technology audits involving shared platforms, centralised infrastructure, and group-wide processes — adapting audit scope and testing to address EU-specific regulatory and licensing requirements while maintaining consistency with global methodology.

1. Audit Planning & Risk Assessment

   • Contribute to the EU risk assessment and annual IT audit plan, considering regulatory priorities, emerging technology risks, business developments, and changes to the ICT environment.
   • Perform walkthroughs and risk assessments with Technology, Cybersecurity, Engineering, Risk, Compliance, and other stakeholders to understand key systems, processes, and control environments.
   • Monitor relevant EU regulatory and technology developments and assess their impact on the audit universe and planned coverage.

1. Reporting & Remediation

   • Develop well-supported audit findings with clear risk articulation, relevant regulatory references, root-cause analysis, and practical remediation recommendations.
   • Prepare concise audit reports and management updates for senior management, the Audit Committee, and other governance forums.
   • Monitor remediation progress and independently validate the implementation and effectiveness of agreed corrective actions.

1. Regulatory & Stakeholder Engagement

   • Support EU regulatory inspections, licensing and post-licensing reviews, and supervisory engagements, including those relating to Bybit EU's MiCA, EMI and MiFID-regulated activities, where relevant to technology and ICT risk.
   • Build effective relationships with Technology, Cybersecurity, Risk, Compliance, Legal, and business stakeholders across the EU and global organisation.
   • Communicate complex technology and regulatory matters clearly to both technical and non-technical stakeholders.
   • Collaborate with 2nd line functions (Compliance, Risk) on integrated assurance over ICT-related regulatory obligations, ensuring technology controls supporting regulatory compliance are appropriately assessed.

1. Global Collaboration & Audit Development

• Act as the EU focal point for the Global IT Audit team — jointly planning and executing technology audits on shared infrastructure, ensuring EU regulatory requirements are embedded in global audit scope, and contributing local expertise to group-wide technology assurance engagements.
• Stay current on developments in digital assets, emerging technologies, cybersecurity risks, and the EU regulatory environment; share insights with global IT audit peers to strengthen cross-regional coverage.
• Promote consistent audit methodologies, knowledge sharing, and a "One Team" approach across regions.

1. Requirements

1. Qualifications & Experience

   • Bachelor's degree in Information Systems, Computer Science, Engineering, Business, Risk Management, or a related discipline.
   • 8–12 years of experience in IT audit, technology risk, ICT risk, or technology assurance, preferably within financial services, fintech, payment services, or regulated digital asset environments.
   • Strong experience leading technology audits independently, from risk assessment and audit planning through fieldwork, reporting, and remediation validation.
   • Demonstrated experience working with cross-border teams and managing senior stakeholders across multiple functions and jurisdictions.
   • Experience within an EU-regulated financial institution, payment/e-money institution, investment firm, or crypto-asset service provider, or experience working directly with EU financial regulators, is highly advantageous.

1. Regulatory & Technical Knowledge

   • Strong understanding of EU ICT and digital finance regulatory requirements, particularly:
     • DORA and associated RTS / delegated regulations;
     • MiCA;
     • MiFID II and relevant technology/control requirements applicable to investment services;
     • EMI and payment services regulatory requirements relevant to ICT governance and operational resilience;
     • GDPR and technology-related data protection requirements;
     • NIS2; and
     • relevant EBA ICT, security, and outsourcing guidelines.
   • Broad knowledge of ICT governance, cybersecurity, identity and access management, cloud environments, third-party risk management, operational resilience, incident management, SDLC, and change management.
   • Working knowledge of major cloud platforms such as AWS, sufficient to assess technology architecture, security controls, and governance arrangements.
   • Understanding of digital asset custody, wallet architecture, cryptographic key management, and blockchain technology is advantageous.
   • Proficiency in data analytics using SQL, Python, and AI-enabled tools to support audit planning, testing, continuous monitoring, and reporting. We build our own tooling — experience with bespoke analytics approaches is valued over off-the-shelf GRC platforms.

1. Soft Skills

   • Strong analytical and critical-thinking skills, with the ability to translate complex ICT and regulatory matters into clear business risk.
   • Strong written and verbal communication skills, including the ability to produce concise, regulatory-quality audit reports.
   • Effective stakeholder management across cultures, functions, and time zones.
   • Self-directed and able to independently manage multiple audit engagements and priorities in a fast-moving environment.

1. Certifications

   • CISA or CISM certification required. Additional certifications (CRISC, CISSP, or equivalent) are advantageous.
   • Additional qualifications or training relating to DORA, cybersecurity, operational resilience, or technology risk are advantageous.

1. Other Requirements

   • High integrity, professional skepticism, sound judgement, and attention to detail.
   • Proficiency in English required; German language capability is highly desirable; Chinese language skills are a plus.
   • Location: EU-based, preferably Austria.
   • Willingness to travel within Europe and internationally where required for audit engagements.

Why Join Us
At Bybit, we are committed to fostering a supportive and enriching work environment.
Our benefits include:
- Study Growth Fund: We support your professional development and continuous learning.
- Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation.
- Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world.
- Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company.
- Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.