IT Security Auditor

The IT Security Auditor is responsible for independently planning and executing a comprehensive security audit of the eVA procurement system and its related business functions. This role ensures compliance with established audit standards and security controls while maintaining independence from risk assessment activities. The auditor will lead interviews, test controls, review third-party assurances, document findings, and prepare detailed reports to support corrective actions. Responsibilities:

• Develop the audit program aligned with VITA SEC530 control families and audit scope.
• Lead kickoff meetings and conduct interviews with DGS DPS, DGS ISS, CGI, and business process owners.
• Test controls including access management, audit logging, configuration, change management, contingency planning, data protection, and vendor oversight.
• Assess security of interfaces such as Cardinal, Bank of America PCard, SWaM certification, and Procurement Data Warehouse.
• Review third-party controls for CGI and SaaS hosted in AWS, leveraging SOC 2 Type II reports as applicable.
• Document audit findings with detailed condition, criteria, cause, effect, and recommendations tied to SEC530 controls.
• Prepare draft and final audit reports and obtain corrective action plans within 10 business days.
• Present audit results at the exit conference.
• Deliver complete work papers and templates upon project completion.

• Minimum 3 years of IT audit experience in public sector or regulated environments.
• Working knowledge of VITA SEC530 and SEC501, NIST SP 800-53, and audit evidence standards.
• Experience applying GAGAS (Yellow Book) or IIA Standards and sampling techniques.
• Audit experience with eProcurement or ERP platforms such as Ivalua, SAP Ariba, Oracle, or similar.
• Ability to review AWS cloud controls, identity and SSO, database, and application controls.
• Strong written communication skills and ability to present findings to executive stakeholders.
• Certified Information Systems Auditor (CISA) certification.

• Certifications such as CISSP, CRISC, CIA, CGAP, CCSK, or AWS Certified Security Specialty.
• Prior experience performing SEC530 audits for Virginia agencies.
• Familiarity with payment card or financial interface audits and PCI DSS awareness.
• Bachelor s degree in IT, Accounting, Cybersecurity, or related field.

• Must remain fully independent from all risk assessment activities.
• US-based candidates only; offshore resources are not permitted.
• Subject to agency-specific background check clearance.

• Hybrid work model with remote work and onsite sessions in Richmond, VA as required, including in-person wrap-up meetings.
• Project duration of seven months, starting second week of January 2027.