Internal Audit Specialist

At Deriv, you'll help strengthen regulatory compliance, operational effectiveness, and governance by delivering independent, evidence-led internal audits across our international business.

This is a hands-on individual contributor role, with regulatory and operational audit as the primary focus. You'll assess risks, test controls, investigate exceptions, and develop clear findings that help the business address weaknesses. You'll also contribute to IT audits as part of the team's wider audit portfolio.

Working with audit managers and colleagues, you'll take ownership of assigned audit work, build your understanding of regulated financial services, and bring curiosity and professional scepticism to every review.

Why This Matters

Deriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders, around the clock, under multiple regulators. Real money, real regulations, real consequences. Independent assurance has to hold up when volumes are high and processes change fast.

AI is already part of how Deriv operates. The processes you audit increasingly run on it, and some of your own audit work will too.

We're in production, not planning.

• 65%+ of customer enquiries resolved entirely by AI, with genuine judgment, not decision trees
• 400+ users on our internal workflow orchestration platform
• Automated security review on every pull request
• Dozens of fraud detection models running continuously in production

We share what we learn. <u>Deriv<ed></u> is where we write about what we're shipping, what breaks, and what we figured out the hard way.

What You'll Do

• Plan audit work. Support risk assessments, process walkthroughs, and the development of audit objectives, scope, and testing programmes.
• Execute regulatory audits. Test controls supporting applicable licensing obligations, AML/CFT, sanctions, customer due diligence, conduct, customer protection, and regulatory reporting.
• Review operational processes. Assess areas such as onboarding, payments and withdrawals, reconciliations, customer operations, complaints handling, outsourcing, procurement, and business continuity.
• Test controls and analyse evidence. Evaluate control design and operating effectiveness through document reviews, interviews, sampling, and data analysis; investigate exceptions and identify root causes.
• Contribute to IT audits. Perform assigned testing of technology-related controls, such as access management, change management, and controls within business applications, with guidance or specialist support where needed.
• Document and communicate findings. Maintain clear, complete working papers and draft findings that explain the evidence, risk, root cause, and practical recommendations.
• Follow up on remediation. Track agreed actions, assess closure evidence, retest controls where appropriate, and escalate delays or unresolved issues to the audit manager.
• Work constructively with stakeholders. Clarify processes and discuss observations with control owners while maintaining independence, confidentiality, and professional judgement.
• Improve audit delivery. Use data analytics, automation, and responsibly governed AI tools to improve testing and efficiency, protecting confidential information and validating outputs.
• Build audit capability. Stay current with relevant regulations, business developments, and professional standards; share learning and support colleagues. At the senior specialist level, lead defined workstreams and help review or coach less-experienced auditors.

Who You Are

• Relevant internal audit or assurance experience, ideally in regulated financial services such as brokerage, trading, payments, banking, or fintech.
• Practical experience performing regulatory or operational audits, including walkthroughs, control testing, evidence assessment, and drafting findings.
• A sound understanding of risk-based auditing, internal controls, and the IIA Global Internal Audit Standards.
• The ability to translate regulatory requirements and business risks into meaningful audit tests.
• A working understanding of technology risks and IT controls, with the ability to contribute to IT audit testing. Specialist IT audit expertise is not the core requirement.
• Strong analytical skills, attention to detail, and the curiosity to investigate inconsistencies rather than accept explanations at face value.
• The ability to manage assigned work, meet deadlines, and communicate clearly with stakeholders. Senior specialists should be able to deliver defined audits or complex workstreams with limited supervision, subject to managerial review.
• Excellent written and spoken English, including the ability to produce clear working papers and concise audit findings.
• A relevant degree in accounting, finance, business, law, information systems, or a related discipline. CIA, CISA, or an equivalent relevant audit qualification is preferred.
• Demonstrable interest in and practical use of analytics, automation, or AI to improve work, supported by appropriate confidentiality safeguards and human judgement.

What Success Looks Like

Well-executed audit work delivered on time, reliable evidence supporting every conclusion, clear findings that identify meaningful risks, and remediation validated thoroughly—not simply marked complete.

The Honest Reality

This is demanding work. You'll investigate exceptions where the first explanation is rarely the full one. You'll deliver findings that control owners won't always welcome, and hold your position while keeping the relationship intact. You'll own assigned work while still learning a regulated business, and deadlines won't wait for you to feel ready.

But you'll build real depth across regulatory, operational, and IT audit in an international fintech, and your findings will change how the business runs.

If you want audit that ends with a report nobody acts on, this isn't it. If you want evidence-led work that matters, it might be.