IT Security Auditor

The IT Security Auditor (Key Personnel) is responsible for independently planning and executing IT security audits of the eVA procurement system and its related business functions. The role ensures compliance with established standards such as GAGAS or IIA, maintaining full independence from risk assessment activities while evaluating security controls, third-party assurances, and interface protections within a hybrid work model based in the US. Responsibilities:

• Develop audit programs aligned with VITA SEC530 control families and validated audit scope.
• Lead kickoff meetings and conduct interviews with DGS DPS, DGS ISS, CGI, and business process/data owners.
• Perform control testing on access control, account management, audit logging, configuration/change management, contingency planning, data protection, and vendor oversight.
• Assess the security of system interfaces including Cardinal, Bank of America PCard, SWaM certification, and the Procurement Data Warehouse.
• Review third-party controls of CGI and SaaS solutions hosted on AWS, leveraging SOC 2 Type II reports where appropriate.
• Document audit findings with detailed condition, criteria, cause, effect, and recommendations linked to audit steps and SEC530 controls.
• Prepare draft and final audit reports, obtain corrective action plans within 10 business days, and present findings at the exit conference.
• Deliver comprehensive work papers and templates upon project completion.

• Minimum 3 years of IT audit experience in public sector or regulated environments.
• Working knowledge of VITA SEC530 and SEC501, NIST SP 800-53, and audit evidence standards.
• Experience applying GAGAS (Yellow Book) or IIA Standards and statistical or judgmental sampling techniques.
• Audit experience with eProcurement or ERP platforms such as Ivalua, SAP Ariba, Oracle, or similar SaaS applications.
• Ability to review AWS cloud controls, identity and single sign-on (SSO), database, and web/mobile application controls.
• Clear written reporting skills and confidence presenting results to CIO and system owner stakeholders.
• Certified Information Systems Auditor (CISA) certification is mandatory.
• Must pass an agency-specific background check.

Preferred Skills & Certifications:

• Certifications such as CISSP, CRISC, CIA, CGAP, CCSK, or AWS Certified Security Specialty.
• Prior experience conducting SEC530 audits for Virginia agencies.
• Familiarity with audits of payment card or financial interfaces and PCI DSS awareness.
• Bachelor s degree in IT, Accounting, Cybersecurity, or related field.

Special Considerations:

• Must remain fully independent from all risk assessment activities.
• US-based only; offshore resources are not permitted.
• Subject to an agency-specific background check clearance.
• Hybrid work model requiring remote work with onsite sessions in Richmond, VA, including in-person wrap-up meetings.