Internal Audit Manager

At Deriv, you'll lead independent, risk-based audits that strengthen regulatory compliance, operational resilience, and governance across our international business.

This is a hands-on managerial role. You'll manage audit engagements from planning through reporting and follow-up, develop auditors, and challenge senior stakeholders constructively. You'll look beyond checklist compliance to identify why controls fail, what those failures mean for the business, and how they can be addressed sustainably.

Your primary focus will be regulatory and operational audits. You'll also manage IT audit engagements as part of the broader audit portfolio, drawing on specialist expertise where needed.

Why this matters

Deriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders, around the clock, under multiple regulators. Real money, real regulations, real consequences. Independent assurance has to hold up when volumes are high and processes change fast.

AI is already part of how Deriv operates. The processes your team audits increasingly run on it, and some of your team's own audit work will too.

We're in production, not planning.

• 65%+ of customer enquiries resolved entirely by AI, with genuine judgment, not decision trees
• 400+ users on our internal workflow orchestration platform
• Automated security review on every pull request
• Dozens of fraud detection models running continuously in production

We share what we learn. <u>Deriv<ed></u> is where we write about what we're shipping, what breaks, and what we figured out the hard way.

What You’ll Do

• Lead risk-based audit planning. Contribute to the annual audit plan by assessing regulatory obligations, business changes, emerging risks, and previous findings across entities and functions.
• Own end-to-end audit delivery. Define engagement objectives, scope, resources, and testing approaches; oversee fieldwork; and review working papers to ensure conclusions are supported by sufficient evidence.
• Assess regulatory compliance. Evaluate controls supporting applicable licensing requirements, AML/CFT, sanctions, customer due diligence, conduct, customer protection, and regulatory reporting.
• Review operational effectiveness. Audit areas such as onboarding, payments and withdrawals, reconciliations, customer operations, complaints handling, outsourcing, procurement, and business continuity.
• Identify material weaknesses. Assess control design and operating effectiveness, establish root causes, and distinguish isolated exceptions from systemic issues.
• Manage IT audit engagements. Oversee scoping, resourcing, delivery, and reporting of IT audits; challenge the adequacy of testing and conclusions; and engage specialist auditors where deeper technical expertise is required.
• Deliver clear, actionable reporting. Produce concise audit reports with well-supported findings, proportionate risk ratings, and practical recommendations. Present results to senior management and support Audit Committee reporting.
• Validate remediation. Agree actions, owners, and deadlines with management; independently verify implementation and effectiveness; and escalate overdue or unresolved material risks. Control ownership remains with the business.
• Lead and develop the team. Allocate work, coach auditors, review performance, and maintain high standards of professional scepticism, documentation, and audit quality.
• Improve how we audit. Use data analytics, automation, and responsibly governed AI tools to strengthen testing coverage and efficiency while protecting confidential information and validating outputs.
• Maintain independence. Build productive relationships with Compliance, Risk, Finance, Operations, and other assurance functions without compromising objective judgement.

What you'll bring

• Substantial internal audit experience in regulated financial services, ideally within brokerage, trading, payments, banking, or fintech.
• Demonstrated ownership of complex regulatory and operational audits, including planning, testing, reporting, and remediation validation.
• Experience managing or supervising auditors and delivering multiple engagements across competing priorities.
• Strong knowledge of the IIA Global Internal Audit Standards, risk-based auditing, governance, and internal control frameworks.
• Sufficient understanding of technology risks and IT controls to manage IT audit engagements, review findings critically, and communicate their business impact. Specialist IT audit expertise is not the core requirement.
• The ability to translate regulatory requirements into practical audit tests and evaluate evidence—not simply review policies.
• Sound commercial judgement and the confidence to challenge senior stakeholders respectfully.
• Excellent written and spoken English, with the ability to explain complex findings clearly.
• A relevant degree in accounting, finance, business, law, or a related discipline. CIA, CISA, or an equivalent relevant audit qualification is preferred.
• Demonstrable use of analytics, automation, or AI to improve audit work, supported by appropriate confidentiality safeguards and human judgement.

What Success Looks Like

High-quality audits delivered on time, material risks clearly communicated, remediation independently validated, and a team that consistently produces rigorous, evidence-led work.

The Honest Reality

This is demanding work. You'll own audit conclusions where the evidence is incomplete and the business disagrees. You'll challenge senior stakeholders and hold your position while keeping the relationship intact. You'll run several engagements at once and still find time to coach the auditors doing the fieldwork. Overdue remediation is your problem to escalate, even when the owner is someone senior.

But you'll shape how audit works in an international, AI-enabled fintech, build a team that produces rigorous work, and put findings in front of the Audit Committee that change how the business runs.

If you want to manage a review cycle and file the reports, this isn't it. If you want to set the standard for how audit is done, it might be.