IT Risk & Cybersecurity Consultant​/Senior Consultant

Location: Kuwait

Department: Risk Consulting – IT Risk & Advisory

Employment Type: Full-Time

As part of the continued expansion of our Risk Consulting and IT Advisory practice,
PKF Kuwait is seeking a qualified and experienced IT Risk & Cybersecurity Consultant / Senior Consultant to join our consulting team.

The successful candidate will be involved in delivering IT audit, cybersecurity, technology risk management, regulatory compliance and IT governance engagements across financial institutions and other industry sectors.

The role offers an opportunity to work on diverse consulting assignments, evaluate complex IT environments and contribute to strengthening clients' technology governance, risk management and internal control frameworks.

• Execute risk-based IT internal audit and technology risk assessment engagements.
• Assess IT General Controls (ITGC), including access management, change management, IT operations, system security, backup and recovery controls.
• Evaluate IT governance frameworks, technology risk management practices, IT policies and procedures, and internal control environments.
• Review application controls, IT infrastructure, system configurations and technology-related business processes.
• Review business continuity, disaster recovery, third-party technology risks and outsourcing arrangements.
• Identify control deficiencies, assess associated risks and recommend practical improvements.

• Conduct cybersecurity risk assessments, information security reviews and control effectiveness evaluations.
• Assess information security governance, identity and access management, vulnerability management, incident response, security monitoring and data protection controls.
• Evaluate cybersecurity policies, procedures and technical safeguards against recognized industry standards and regulatory requirements.
• Review business continuity management, disaster recovery arrangements and operational resilience capabilities.
• Assess third-party technology risks, outsourcing arrangements and vendor security management practices.

• Execute IT regulatory compliance reviews and gap assessments for financial institutions and other regulated entities.
• Assess the adequacy and effectiveness of technology controls against applicable regulatory requirements and industry frameworks.
• Perform control design and operating effectiveness assessments through walkthroughs, stakeholder interviews, documentation reviews and evidence-based testing.
• Lead end-to-end audits to ensure continuous alignment with local CBK regulatory frameworks and global relevant frameworks and standards, including ISO/IEC 27001, NIST, COBIT, SOC 2 and other applicable technology governance and cybersecurity requirements.
• Support regulatory readiness assessments, compliance reviews and remediation validation engagements.

• Develop risk and control matrices, audit programs, assessment checklists and detailed testing procedures.
• Conduct client walkthroughs, interviews and technical control assessments.
• Review technical documentation, system-generated reports, configurations and other supporting evidence.
• Prepare comprehensive working papers, gap analysis reports, audit observations and recommendations.
• Draft professional reports and presentations communicating key findings, associated risks and recommended corrective actions.
• Coordinate with client stakeholders and internal engagement teams to ensure timely completion of assignments.

• Contribute to the enhancement of IT audit methodologies, assessment tools, working papers and reporting templates.
• Support technical scoping, engagement planning and proposal preparation.
• Stay updated on emerging cybersecurity risks, regulatory developments and technology governance standards.
• Collaborate with multidisciplinary consulting teams in delivering integrated risk advisory engagements.

• Bachelor's degree in Information Technology, Computer Science, Information Systems, Cybersecurity or a related field.
• Minimum of 5+ years of relevant professional experience in IT audit, information security, cybersecurity, cyber resilience, technology risk management, IT advisory or related consulting services.
• Experience in…