IT Audit Manager

We are seeking an experienced IT Audit Manager / Senior Manager to lead and execute risk-based technology audits across our EU operations, with a focus on ICT risk governance, cybersecurity, operational resilience, data protection, third-party risk management, and technology governance.

Based in the EU region, preferably Austria, the role will play a key part in shaping and delivering the EU technology audit programme and ensuring appropriate audit coverage of applicable regulatory requirements, including DORA and related RTS and delegated regulations, MiCA, GDPR, NIS2, relevant EBA guidelines, and other applicable EU and local ICT and digital finance requirements.

The successful candidate will work closely with Technology, Engineering, Cybersecurity, Risk, Compliance, and other cross-functional teams to assess the design and effectiveness of ICT controls and provide independent, practical, and risk-based assurance across a fast-moving digital asset environment.

The role reports to the EU Head of Audit, with a dotted reporting line to the Global Head of IT Audit. The ideal candidate will combine strong IT audit and ICT risk expertise with a sound understanding of the EU regulatory landscape and the ability to independently lead complex, cross-border technology audits within a global organisation.

Responsibilities

EU Technology Audit Delivery

Lead and execute risk-based IT audits across EU operations, covering key technology, cybersecurity, ICT risk, operational resilience, data protection, and third-party risk areas.

Assess the design and effectiveness of ICT governance and controls against applicable EU regulatory requirements, including DORA and related RTS/delegated regulations, MiCA, MiFID II, EMI/payment services requirements, GDPR, NIS2, and relevant EBA guidelines.

Work closely with the Global IT Audit team on technology audits involving shared platforms, centralised infrastructure, and group-wide processes — adapting audit scope and testing to address EU-specific regulatory and licensing requirements while maintaining consistency with global methodology.

Audit Planning & Risk Assessment

Contribute to the EU risk assessment and annual IT audit plan, considering regulatory priorities, emerging technology risks, business developments, and changes to the ICT environment.

Perform walkthroughs and risk assessments with Technology, Cybersecurity, Engineering, Risk, Compliance, and other stakeholders to understand key systems, processes, and control environments.

Monitor relevant EU regulatory and technology developments and assess their impact on the audit universe and planned coverage.

Reporting & Remediation

Develop well-supported audit findings with clear risk articulation, relevant regulatory references, root-cause analysis, and practical remediation recommendations.

Prepare concise audit reports and management updates for senior management, the Audit Committee, and other governance forums.

Monitor remediation progress and independently validate the implementation and effectiveness of agreed corrective actions.

Regulatory & Stakeholder Engagement

Support EU regulatory inspections, licensing and post-licensing reviews, and supervisory engagements, including those relating to Bybit EU's MiCA, EMI and MiFID-regulated activities, where relevant to technology and ICT risk.

Build effective relationships with Technology, Cybersecurity, Risk, Compliance, Legal, and business stakeholders across the EU and global organisation.

Communicate complex technology and regulatory matters clearly to both technical and non-technical stakeholders.

Collaborate with 2nd line functions (Compliance, Risk) on integrated assurance over ICT-related regulatory obligations, ensuring technology controls supporting regulatory compliance are appropriately assessed.

Global Collaboration & Audit Development

Act as the EU focal point for the Global IT Audit team — jointly planning and executing technology audits on shared infrastructure, ensuring EU regulatory requirements are embedded in global audit scope, and contributing local expertise to group-wide technology assurance engagements.

Stay current on developments in digital assets, emerging technologies, cybersecurity risks, and the EU regulatory environment; share insights with global IT audit peers to strengthen cross-regional coverage.

Promote consistent audit methodologies, knowledge sharing, and a "One Team" approach across regions.

Requirements

Qualifications & Experience

Bachelor's degree in Information Systems, Computer Science, Engineering, Business, Risk Management, or a related discipline.

8–12 years of experience in IT audit, technology risk, ICT risk, or technology assurance, preferably within financial services, fintech, payment services, or regulated digital asset environments.

Strong experience leading technology audits independently, from risk assessment and audit planning through fieldwork, reporting, and remediation validation.

Demonstrated experience working with cross-border teams and managing senior stakeholders across multiple functions and jurisdictions.

Experience within an EU-regulated financial institution, payment/e-money institution, investment firm, or crypto-asset service provider, or experience working directly with EU financial regulators, is highly advantageous.

Regulatory & Technical Knowledge

Strong understanding of EU ICT and digital finance regulatory requirements, particularly:

DORA and associated RTS / delegated regulations;

MiCA;

MiFID II and relevant technology/control requirements applicable to investment services;

EMI and payment services regulatory requirements relevant to ICT governance and operational resilience;

GDPR and technology-related data protection requirements;

NIS2; and

relevant EBA ICT, security, and outsourcing guidelines.

Broad knowledge of ICT governance, cybersecurity, identity and access management, cloud environments, third-party risk management, operational resilience, incident management, SDLC, and change management.

Working knowledge of major cloud platforms such as AWS, sufficient to assess technology architecture, security controls, and governance arrangements.

Understanding of digital asset custody, wallet architecture, cryptographic key management, and blockchain technology is advantageous.

Proficiency in data analytics using SQL, Python, and AI-enabled tools to support audit planning, testing, continuous monitoring, and reporting. We build our own tooling — experience with bespoke analytics approaches is valued over off-the-shelf GRC platforms.

Soft Skills

Strong analytical and critical-thinking skills, with the ability to translate complex ICT and regulatory matters into clear business risk.

Strong written and verbal communication skills, including the ability to produce concise, regulatory-quality audit reports.

Effective stakeholder management across cultures, functions, and time zones.

Self-directed and able to independently manage multiple audit engagements and priorities in a fast-moving environment.

Certifications

CISA or CISM certification required. Additional certifications (CRISC, CISSP, or equivalent) are advantageous.

Additional qualifications or training relating to DORA, cybersecurity, operational resilience, or technology risk are advantageous.

Other Requirements

High integrity, professional skepticism, sound judgement, and attention to detail.

Proficiency in English required; German language capability is highly desirable; Chinese language skills are a plus.

Location: EU-based, preferably Austria.

Willingness to travel within Europe and internationally where required for audit engagements.