How to get hired
The CISA is issued by ISACA. You can sit the exam before you have the experience, but to be certified you need five years of professional information systems audit, control or security work within the ten years before you apply, and you must apply within five years of passing. After that, you report at least 20 CPE hours a year and 120 over each three-year period. So "CISA" on a job post usually means a mid-level role, and early-career people get in through the routes below and certify on the way.
From statutory or internal audit
Auditors already test controls; IT audit tests the controls that sit in systems. The common first role is IT general controls (ITGC) testing for SOX or statutory audits: user access reviews, change management, backups, segregation of duties in SAP or Oracle. Big 4 assurance and risk teams hire CAs and CA Inters with audit experience into "Senior – IT Controls" or technology risk roles and train them. CAs can also take ICAI's DISA course, which many Indian firms recognise for bank and IS audits.
From IT, networks or security
System administrators, network engineers and security analysts move across by learning audit method: how to write a control, test it, sample evidence and write a finding a manager accepts. Their edge is reading logs, firewall rules and cloud configurations. ISO 27001 lead auditor or implementer training is a common bridge, and many cyber-risk and GRC posts ask for it alongside CISA. The cybersecurity guide covers the technical side.
Banks, NBFCs and fintech
RBI-regulated entities must have their IT and information security audited, and banks, NBFCs, payment firms and fintechs hire IS auditors and third-party risk staff ("Deputy Manager – Third Party Risk Management", "Manager – Audit"). Audit firms that do bank IS audits hire for the same skills. Read the RBI directions that apply to the sector you target; interviews often ask about one.
Audit firms and security consultancies
CERT-In empanelled auditing organisations and payment-security firms run IS audits, VAPT and compliance reviews (PCI DSS for card data, SOC reports for service providers). They hire both auditors and technical testers, and are a fast place to collect the varied experience the CISA asks for.
What interviews test
- Walk through how you would test user access for a finance system, from population to sample to conclusion.
- Explain the difference between a design deficiency and an operating deficiency.
- Describe a SOC 1 vs a SOC 2 report and when a company relies on each.
- Read a short access-review extract and spot the problem.
What the work is like
IT audit is documentation-heavy and calendar-driven, following the client's audit cycle: planning, walkthroughs, interim testing, year-end roll-forward. Big 4 and GCC teams serving US clients see peaks from October to February. The ladder runs Consultant, Senior, Manager, Senior Manager, then head of IT audit or a CISO-office risk role. CISM and CRISC are the usual next credentials for people heading towards security governance; CIA for those staying in internal audit.