Lead Internal Auditor - IT

Jakarta · 6-8 years experience · Full-time · Onsite · Posted Sep 30, 2026

At a glance

GoTo is the largest digital ecosystem in Indonesia. GoTo's mission is to 'empower progress' by offering technology infrastructure and solutions that help everyone to access and thrive in the digital economy.
The GoTo ecosystem provides a wide range of services, including mobility, delivery, payments, financial services, and technology solutions for merchants. The ecosystem also provides e-commerce services through Tokopedia and banking services through its partnership with Bank Jago.

Lead Internal Auditor - IT position at GoTo Group located in Jakarta.
Responsible for planning and executing risk-based audits across payment systems and processes.

Plan and execute risk-based audits across payment systems and processes, covering areas such as payment processing, transaction lifecycle, reconciliation, settlement, refunds, chargebacks, and payment operations.
Assess end-to-end business processes to identify control gaps, operational inefficiencies, leakage points, and potential fraud risks, and evaluate the adequacy and effectiveness of existing controls.
Evaluate application controls, automated controls, system integrations, data flows, access controls, and technology-enabled processes supporting payment systems.
Conduct risk assessments, define audit scope and testing procedures, perform fieldwork and control testing, analyze evidence, and ensure audit working papers meet established audit methodology and quality standards.
Develop clear and concise audit findings, identify root causes and potential business impacts, and provide practical recommendations to strengthen payment controls and mitigate identified risks.
Partner with process owners and business stakeholders to validate audit findings, communicate key risks, and monitor management action plans through to timely remediation.
Contribute to enhancing audit methodologies, data analytics, control testing approaches, and continuous monitoring techniques for payment-related risks.

Strong knowledge of IT audit, risk-based audit methodologies, internal control frameworks, application and automated controls, system integrations, and technology risk.
CISA (Certified Information Systems Auditor) certification is mandatory, given the technology-focused audit scope and regulatory exposure.
Strong analytical and problem-solving skills, with the ability to assess complex payment processes, identify control weaknesses, perform root-cause analysis, and develop practical recommendations.
Strong written and verbal English communication skills, with the ability to clearly communicate audit findings and prepare concise audit reports and documentation.
Strong stakeholder and project management capabilities, with the ability to work effectively with business, technology, finance, risk, and regulatory stakeholders under tight timelines.

Experience in payment systems or technology-enabled financial services highly preferred.
Strong experience in payment systems, payment processing, transaction flows, reconciliation, settlement, digital payments, fintech, or other technology-driven financial ecosystems is highly preferred.
Familiarity with Bank Indonesia (BI) regulations, regulatory requirements, and supervisory expectations, particularly those relevant to payment systems, technology risk, information security, and internal controls, is highly preferred.