Information Systems Audit Officer

Group Company: Meralco PowerGen Corporation

Designation: Information Systems Audit Officer

Office Location: Pasig City (MGEN_HO)

Position description: The Information Systems Audit Officer job involves leading or conducting performance, operations, and compliance audit projects involving systems and information technology (IT); providing consulting services to the organization’s management and staff; and providing input to the development of the annual internal audit plan. The Information Systems Audit Officer is responsible for identifying technology risks and independently evaluating the efficiency and effectiveness of information technology infrastructure and application controls, including security and internal controls.

Primary Responsibilities:

• Audit Execution and Control Evaluation
• Execute the IT audit plans in accordance with established audit methodologies, evaluating the adequacy and effectiveness of internal controls and identifying areas of potential risk.
• Perform audit procedures, including identifying and defining issues, developing criteria, reviewing, and analyzing evidence, and documenting client processes and procedures.
• Conduct reviews including review of IT general and applications controls for enterprise-wide core and support systems (e.g., SAP, SCADA/OT, HRIS, etc.), IT infrastructure, and operations of the IT Department.
• Work independently with general guidance, allowing for significant initiative and independent judgment.
• Provide advisory support on IT governance, cybersecurity risk management, and systems implementation reviews.
• Conduct interviews, review documents, develop, and compose summary memos, and prepare working papers.
• Identify, develop, and document audit issues and recommendations using independent judgment concerning areas being reviewed. 50% 2. Reporting, Documentation and Follow-up
• Prepare audit reports supported by evidence-based working papers for review by senior IS audit personnel.
• Document process walkthroughs, audit procedures, control testing results, and supporting evidence in compliance with applicable audit documentation standards
• Assist the Information Systems Audit Manager in communicating audit observations and recommendations with department heads and process owners to ensure mutual understanding and buy-in, and monitor the timely implementation of agreed action plans to ensure resolution of identified issues.
• Conduct follow up audits to monitor interventions from management and ensure that previously noted issues are remediated as committed by process owners.
• Ensure strict adherence to documentation requirements throughout all phases of the audit process, including planning, fieldwork, reporting, and follow-up, in accordance with internal audit methodology, regulatory expectations, and quality assurance standards.
  
  

Additional Responsibilities:

• IT Audit Planning and Risk Assessment
• Support the Information Systems Audit Manager in the development of a riskbased IT audit plan that covers key areas of the organization’s operations, processes, and systems.
• Assist in conducting a risk assessment to identify technological risks including cybersecurity, data privacy, IT general controls, application controls, SCADA/OT systems and digital transformation projects.
• Maintain all organizational and professional ethical standards and ensures internal audit activities are carried out in compliance with The IIA’s International Standards for Professional Practice (IPPF) and other Internal Auditing Standards such as Control Objectives for Information and Related Technologies (COBIT), National Institute of Standards and Technology (NIST), Information Technology Infrastructure Library (ITIL), International Organization for Standardization (ISO), etc. 10% 4. Cybersecurity and Data Protection Assurance
• Support audits focused on cybersecurity policies, incident response, data privacy, and business continuity.
• Review system configurations, user provisioning, and third-party access controls to assess vulnerabilities.
• Review and assess information technology control elements to mitigate IT risks regarding the confidentiality, integrity, and availability of business information.
• Document and communicate observations related to cybersecurity risks and propose mitigating controls. 10% 5. Stakeholder Engagement and Continuous Improvement
• Build and maintain effective working relationships with external and internal stakeholders to promote a culture of transparency, accountability, and continuous improvement.
• Share insights and best practices to support continuous improvement in business processes and control environments Contribute to the enhancement of audit tools, procedures, and reporting standards.
• Maintain up-to-date knowledge of industry developments, evolving information technology standards, and emerging risks relevant to the power generation sector, with particular focus on newly implemented systems, technologies, and operational innovations.
  
  

Reporting Team

• Reporting Designation:
• Reporting Department:
  
  

Educational Qualifications Preferred

• Category:
• Field specialization:
• Degree:
• Academic score:
• Institution tier:
  
  

Required Certification/s:

Required Training/s:

Required Work Experience

• Industry:
• Role:
• Years of experience:
  
  

Key Performance Indicators:

Required Competencies: This role requires a foundational understanding of information systems, cybersecurity, and audit methodology. The IS Audit Officer must demonstrate attention to detail, analytical thinking, and professional integrity in evaluating risks within both enterprise IT and operational environments. Competencies include IT control evaluation, technical documentation review, problem-solving, written communication, and collaboration with both technical and non-technical stakeholders. The ability to manage sensitive information with discretion and independently under guidance is critical in supporting secure and compliant energy operations. Or within cross-functional teams in highcompliance, safety-critical environments

Required Knowledge: Bachelor’s degree in Information Technology, Computer Science, Information Systems, or related discipline. ▪ 2–4 years of experience in IT audit, cybersecurity assessment, or systems risk management; experience in a regulated industry (energy/utilities) is an advantage. ▪ Working knowledge of IT control frameworks such as COBIT, NIST, ISO 27001, or similar standards. ▪ Certification (or working toward) CISA, CISM, or equivalent is preferred. ▪ Proficiency in Microsoft Office; familiarity with ERP systems, audit tools, and cybersecurity platforms is a plus. ▪ Effective communication, analytical, and technical writing skills.

Required Skills:

Required Abilities

• Physical:
• Other:
  
  

Work Environment Details:

Specific Requirements

• Travel:
• Vehicle:
• Work Permit:
  
  

Other Details

• Pay Rate:
• Contract Types:
• Time Constraints:
• Compliance Related:
• Union Affiliation:

---