IT Audit Specialist

IT Audit Specialist

General Description:
Their responsibility is to evaluate and ensure the effectiveness, security, and compliance of College Computing information technology systems, processes, and controls. This role is a core Security Operations and Risk Architecture position focused on strengthening infrastructure resilience and system integrity. Their work is essential for safeguarding digital assets, maintaining regulatory compliance, and identifying areas of improvement within IT infrastructure. The role supports regular system access reviews and drives the human-defense layer via continuous security training. By optimizing incident response playbooks and managing technical third-party risk, this position is vital for neutralizing vulnerabilities, minimizing downtime, and proactively engineering a more secure IT infrastructure.

Duties Responsibilities

• Ensure IT operations comply with relevant laws, regulations, and standards (e.g., GDPR, HIPAA, FERPA, NIST CSF).
• Collaborate with technical teams to validate controls, collect evidence, and maintain the official Compliance Tracker.
• Third Party & Supplier Risk Assessments : Perform vendor reviews, document findings, and support risk mitigation activities.
• BIA and Risk Assessments: Collaborate on technical impact analyses to align system recovery objectives with operational requirements and continuity profiles.
• KnowBe4 Platform Operations: Orchestrate automated security training workflows and analyze engagement metrics to quantify and reduce human-centric risk.
• Phishing Assessments (MS Attack Simulator): Leverage MS Attack Simulator to execute controlled social engineering tests, using the data to harden email security filters and user response protocols.
• Incident Response (IR) Playbooks & IR Plan : Update and standardized playbooks in alignment with NIST CSF; ensure quarterly reviews and accessibility for stakeholders.
• IR Tabletop Exercises: Facilitate technical tabletop simulations to identify process bottlenecks, documenting “lessons learned” to optimize future response speed.
• Identity & Access Management (AD): Review & evaluate Active Directory to enforce the Principle of Least Privilege (PoLP) and remediate unauthorized access paths.
• CIS Controls Assessments & CSAT Tool: Conduct internal assessments to measure control maturity and drive technical roadmap improvements.
• Control Validation: Develop and maintain a centralized dashboard to track security control health and document the verification of technical safeguards.
• POA&M Maintenance: Manage the technical remediation pipeline, coordinating with cross-functional teams to patch security gaps and close open vulnerabilities.

KSA Requirements:

• Knowledge of IT infrastructure, networks, applications, and cybersecurity principles.
• Demonstrated analytical skills and attention to detail in reviewing processes, documentation, and managing evidence.
• Capable of clear, concise reporting to both technical and non-technical stakeholders.
• Ability to collaborate with technical teams to validate controls, collect evidence, and maintain the official Compliance Tracker.
• Ability to manage and maintain audit documentation and evidence repositories, ensuring organization and accessibility for internal and external reviews.
• Ability to Identify potential vulnerabilities and risks; contribute to annual Business Impact Analysis (BIA) and Risk Assessments.

Minimum Work Experience:

• Experience with major security frameworks (e.g., NIST CSF, CIS Controls).
• Experience in IT audit, security, risk management, or compliance.
• Experience with Microsoft Office

Additional Considerations:

• Professional certification such as CISA (Certified Information Systems Auditor).

For further information and to Apply:

VCCS is an Equal Employment Opportunity employer.