CISA Jobs in India (Certified Information Systems Auditor)

Both routes work, and teams usually hold a mix. People from a technology background bring an understanding of how systems and access actually behave; Chartered Accountants and internal auditors bring testing discipline and an understanding of what a control is protecting. What every employer wants is someone who can look at an application and say who can do what in it, how that was approved, and what evidence proves it. The qualification from ISACA is the common signal for that.

IT general controls are the foundations underneath every automated financial control, and testing them means examining four areas: who has access to an application and how that access was requested, approved and reviewed; how a change reaches production and who authorised it; whether scheduled jobs and interfaces ran completely and correctly, with failures investigated; and whether backups and recovery work. In companies with a US-listed parent this is tested every year as part of SOX, which is why ITGC experience appears in so many job descriptions.

Pre- and post-implementation reviews of ERP programmes, cloud configuration reviews on AWS or Azure, third-party and vendor risk assessments, business continuity and disaster recovery testing, data privacy reviews, and readiness or attestation work such as ISO 27001 and SOC 1 and SOC 2. In banks and NBFCs there is a further strand: assessments against the Reserve Bank of India’s information technology and cyber security directions, and support for its inspections. Adjacent openings are on the compliance jobs and risk jobs pages.

Name the environments you have actually tested — SAP, Oracle, Workday, Salesforce, AWS, Azure — and say what you examined in each, not just that you know them. State the framework you worked to: COBIT, a US-listed parent’s SOX programme, an RBI inspection, ISO 27001. Then give one example with an outcome, such as a segregation-of-duties conflict you found and the access change that followed. Generic lines about “IT risk and governance” are the fastest way to be filtered out.

At the same number of years it usually does, because the supply of people who can test both systems and processes is smaller. The gap is widest in banks and in consulting, and narrower inside capability centres where grades are standardised across audit teams. Treat it as one factor among several: the breadth of environments you will see in the first two years matters more for your next move than a small difference at the start.

Bengaluru carries most of the listings on this page at the moment, with Mumbai next for banks, NBFCs and insurers. Hyderabad, Gurugram, Pune and Chennai add capability-centre and consulting roles, so check the list above rather than assuming a city has openings. Filter all job vacancies by the CISA qualification plus city, and see CIA jobs if you want the process-audit side as well.