IT Audit Liaison

The OA-EISO-Audit Liaison serves as a critical support role within the Enterprise Information Security Office (EISO), assisting the Commonwealth’s Governance, Risk, and Compliance (GRC) Department. Reporting to the IT Governance, Risk and Compliance Manager, this position facilitates IT audit coordination, evaluates information security controls, identifies compliance gaps, and supports remediation efforts to enhance cybersecurity and regulatory compliance. Responsibilities:

• Coordinate and support IT audits conducted by internal and external oversight entities, including state auditors and regulatory bodies.
• Review documentation and technical evidence to assess compliance with laws, regulations, policies, and security standards.
• Evaluate information security and technology controls against frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and Commonwealth security policies.
• Identify control deficiencies, document findings, and recommend corrective actions to mitigate risks.
• Assist stakeholders in preparing audit responses and gathering supporting evidence.
• Track audit findings, validate corrective actions, and report remediation status and residual risk to management.
• Support the development and maintenance of automated workflows for audit management, compliance tracking, and evidence collection.
• Create dashboards, metrics, and executive reports on audit trends, compliance posture, and remediation progress.
• Perform risk-based assessments to prioritize audit activities and evaluate control effectiveness.
• Assist in developing audit procedures, compliance documentation, metrics, and management reports.
• Participate in continuous improvement initiatives related to governance, risk management, and internal controls.

• Knowledge of IT auditing principles and practices.
• Experience evaluating information security and technology controls against established frameworks.
• Ability to analyze technical and audit documentation and evaluate compliance with policies and standards.
• Strong report writing and communication skills for technical and non-technical audiences.
• Experience tracking audit findings and managing remediation efforts.
• Ability to support audit management automation and develop compliance metrics and reports.

Preferred Skills & Certifications:

• Familiarity with cybersecurity governance and risk management.
• Knowledge of NIST CSF, NIST SP 800-53, ISO 27001, and related security frameworks.
• Professional certifications such as CISA, CRISC, CISM, or equivalent.
• Experience supporting IT audits, regulatory examinations, or compliance assessments.

Special Considerations:

• Strict prohibition on taking or using government equipment outside of the United States.
• Non-compliance with equipment use policy results in immediate termination and ineligibility for rehire.