IT Auditor

The IT Auditor is responsible for conducting detailed security and compliance audits of the DMAS RightFax system. This role involves executing approved audit procedures, evaluating evidence, documenting results, and preparing comprehensive audit workpapers in compliance with Commonwealth of Virginia standards and GAGAS guidelines. The auditor ensures control effectiveness and supports the audit lifecycle from planning through reporting. Responsibilities:

• Participate in entrance conferences to confirm audit scope, limitations, expectations, and scheduling.
• Develop and execute audit procedures addressing SEC530-01.2 controls and other approved criteria.
• Assess control design and implementation using SEC502-05, SEC520-06, NIST SP 800-53 Revision 5, and related standards.
• Conduct interviews, walkthroughs, evidence reviews, sampling, and control testing independently from internal audit.
• Maintain an evidence-request tracker including descriptions, owners, due dates, receipt dates, and follow-ups.
• Prepare clear, referenced workpapers linking controls, procedures, evidence, test results, and conclusions.
• Document failed controls and draft findings with condition, criteria, cause, effect, and recommendations.
• Support validation of findings, draft and final report preparation, exit conferences, and secure transfer of audit materials., * Work primarily remote with occasional on-site visits scheduled as required by the client.
• Must maintain independence from DMAS Internal Audit during audit activities.
• Strict adherence to Commonwealth of Virginia and GAGAS audit standards.

Scheduling:

• Remote work mode with flexibility for scheduled client visits.
• Work schedule aligned with audit project timelines and entrance/exit conferences.

• Minimum of five years of IT audit experience.
• Experience with VITA security standards or NIST SP 800-53.
• Proficiency in IT security, compliance, and control-effectiveness audits.
• Ability to evaluate access control, audit logging, configuration management, contingency planning, authentication, risk management, system protection, and system integrity controls.
• Strong skills in evidence analysis, interviewing, sampling, workpaper documentation, and report writing.
• Ability to protect sensitive audit information and use approved secure collaboration and communication methods.
• Certified Information Systems Auditor (CISA) or equivalent IT audit certification (e.g., CIA, CISSP, CRISC, GSNA) accepted by DMAS.
• Experience auditing Commonwealth of Virginia agencies or systems.
• Working knowledge of GAGAS Yellow Book requirements and government audit documentation practices.
• Proficiency with Microsoft Word, Excel, SharePoint, and editable electronic workpaper packages.

Preferred Skills & Certifications:

• Additional relevant IT audit certifications recognized by DMAS.
• Experience with secure communication and collaboration technologies.
• Familiarity with DMAS RightFax system or similar enterprise fax systems.