IT Auditor

The IT Auditor is responsible for performing hands-on testing of SEC530 security controls for the DMAS MFT System, executing approved audit programs, collecting and evaluating evidence, documenting workpapers, and drafting findings in compliance with VITA, NIST, and GAGAS standards. This role ensures the effectiveness and compliance of IT security controls through detailed audits and collaboration with system and data owners. Responsibilities:

• Support entrance conferences, audit planning, and development of audit procedures.
• Prepare and track audit evidence requests with DMAS staff.
• Test Appendix A controls including AC, AU, CM, IA, RA, SC, SI, CP, CA, and PS families.
• Conduct interviews and walkthroughs with system owners, data owners, and technical leads.
• Document test steps, evidence, results, and exceptions in traceable workpapers.
• Draft findings including condition, criteria, cause, effect, and recommendation mapped to SEC530 controls.
• Support draft report preparation, final report issuance, exit conferences, and workpaper handover.
• Protect sensitive evidence using DMAS SharePoint and encrypted email methods.

• Minimum 5+ years of IT audit experience.
• Considerable experience with VITA Standards or NIST SP 800-53 Rev. 5 control assessment.
• Knowledge of GAGAS (Yellow Book) audit requirements.
• Experience testing access control, authentication, logging, configuration, and change management.
• Skills in reviewing encryption, vulnerability scanning, flaw remediation, and backup controls.
• Strong audit documentation and business writing skills.
• CISA certification preferred; similar certifications such as CISSP, CIA, CRISC, or CISM are acceptable.

Preferred Skills & Certifications:

• Prior IT security audit experience at Commonwealth of Virginia agencies.
• Bachelor’s degree in Information Systems, Cybersecurity, Accounting, or related field.
• Experience auditing file transfer, SFTP, or data exchange systems.

Special Considerations:

• Strict adherence to protecting sensitive evidence using secure platforms and encrypted communication.

Scheduling:

• Standard professional work schedule; specific shift details not provided.