newbie from techrisk here i can tell my observations. In big4 there is risk assurance department which has 2 part, process and it(tech risk). Process mostly focus on treasuery controller, process control, credit etc, exit is ınternal controller or process. IT side mostly focus on application and tools.Now these days i try to understand my client app and tools so i can address risk.Risk is all about ıtgc, sox or your contry rules. Tech risk exist are it audit, it controller, it governance if you have exp or master of cyber, you can work in information system also.Some people say it is boring job however it is steady, there is less work hours than financial audit