IT Security Auditor

Job Summary:

The Senior IT Security Auditor / Technical Security SME is responsible for performing hands-on security control testing and technical evidence analysis in various IT environments including Fairfax Quick Modules, PrintSafe, and Prisma Print. This role involves leading technical walkthroughs, sampling, preparing audit work papers, and developing initial findings to ensure compliance with security standards and effective risk management. Responsibilities:

• Execute system-specific SEC530 audit procedures.
• Conduct technical walkthroughs and analyze configurations, reports, logs, access records, tickets, vulnerability results, and vendor documentation.
• Test controls related to access management, timely access termination, privileged access, authentication, logging, configuration management, vulnerability remediation, encryption, backup, recovery, and system integrity.
• Assess controls across AWS-hosted SaaS, Windows Server, Active Directory, SQL Server, endpoints, interfaces, and enterprise print platforms.
• Review third-party controls and assurance documentation for service providers.
• Prepare complete, traceable, evidence-supported audit work papers.
• Document control exceptions and support findings development with practical recommendations.
• Support finding reviews, corrective action plan validation, exit conferences, and final reporting.

Required Skills & Certifications:

• 7+ years of experience in IT security assessment, IT audit, cybersecurity, or technology risk.
• 4+ years of hands-on technical security control testing.
• Experience with Commonwealth of Virginia standards such as SEC530, SEC502, SEC520.
• Experience auditing financial, tax, payment-processing, or revenue systems handling sensitive financial data.
• Familiarity with NIST SP 800-53 security control testing.
• Experience assessing cloud/SaaS environments, Windows infrastructure, SQL Server, identity and access management, and third-party services.
• Proven ability to prepare audit work papers and technical findings.
• Strong skills in AWS shared-responsibility assessment, Active Directory, endpoint and SQL security, privileged access testing, logging/monitoring, configuration/patch management, encryption, backup/recovery, and SOC report review.
• CISA and/or CISSP certification strongly preferred.

Preferred Skills & Certifications:

• Experience in enterprise print-management or production-printing security.
• Government or regulated-industry assessment experience.
• AWS Certified Security, CCSP, Security+, CRISC, or relevant Microsoft security certifications.

Special Considerations:

• Must be able to handle sensitive financial and security data with discretion.

Scheduling:

• Duration: 3 months.
• Work schedule: 40 hours per week.