IT Auditor

The IT Auditor will conduct comprehensive information security audits for the Virginia Department of Health Professions, focusing on both on-premises and cloud-based systems. This role involves planning, executing, and reporting on audits in accordance with established standards and regulations, ensuring compliance and risk management of critical IT environments. Responsibilities:

• Develop risk-based IT audit procedures and programs for MLO on-premises and PMP cloud SaaS systems.
• Review SEC530 controls to define audit objectives, testing procedures, and evidence requirements.
• Lead or support entrance conferences to establish audit scope, responsibilities, and schedules.
• Maintain audit evidence request trackers and follow up on documentation.
• Conduct interviews and walkthroughs with system owners, security personnel, and third-party providers.
• Evaluate control design and evidence for identity/access management, authentication, logging, configuration, vulnerability management, encryption, backup, recovery, incident response, and system integrity.
• Assess on-premises application, infrastructure, database, network, and security controls for MLO.
• Evaluate SaaS and shared-responsibility controls for PMP, including COVRamp and SOC 2 documentation.
• Prepare complete workpapers documenting audit procedures, evidence, analysis, and conclusions.
• Develop detailed audit findings with conditions, causes, effects, and recommendations.
• Prepare draft and final audit reports for both systems, including management responses and corrective plans.
• Present audit results during findings discussions and exit conferences.
• Submit weekly status updates on progress, risks, and corrective actions.
• Escalate significant issues within 24 hours as required.

• Minimum three years of professional IT audit, cybersecurity assessment, or information security compliance experience.
• Experience auditing government agencies or regulated organizations.
• Knowledge of Commonwealth of Virginia security standards (SEC530, SEC502, SEC520).
• Experience with GAGAS Yellow Book or IIA internal audit standards.
• Ability to assess NIST SP 800-53 controls and develop audit programs and reports.
• Experience auditing on-premises COTS applications and cloud-based SaaS environments.
• Review of third-party assurance documentation including SOC 2 and cloud security packages.
• Skills in IT security control assessment, risk-based audit planning, evidence validation, and technical report writing.
• Strong stakeholder communication and findings presentation skills.
• Project planning, status reporting, risk tracking, and issue escalation capabilities.

• Certified Information Systems Auditor (CISA).
• Certified Information Security Manager (CISM).

• Hybrid work model requiring entrance and exit meetings on-site in Henrico, Virginia, with other audit activities performed remotely within the Continental United States.
• Strict adherence to audit standards and timely escalation of significant issues.

• Flexible audit scheduling with on-site meetings as required; primarily hybrid with remote work opportunities.
• Weekly status updates and adherence to agreed audit timelines.