IT Security Auditor

STI; Richmond (VA); On-site; USD 90,000 - 120,000; Full time

Job summary

STI is seeking an experienced IT auditor for the SCC Health Benefit Exchange division in Richmond, VA. You will assess security controls, guide remediation, and help implement updated standards across internal processes and external partners.

Responsibilities include developing assessment tools, training staff, and aligning vendor contracts with information security requirements. Strong analytics and communication are essential.

Qualifications

• Experience auditing IT controls and security programs.
• Familiarity with CMS/IRS security standards and SCC requirements.
• Strong communication and report writing skills.

Responsibilities

• Assess current security controls against new CMS, IRS, and SCC standards.
• Identify gaps and remediation steps to achieve compliance.
• Plan and update policies, procedures, and documentation.
• Design tools and workflows to assess partners and vendors.
• Develop scoring to measure vendor security controls.
• Evaluate vendor security postures and data-sharing requirements.
• Test effectiveness of controls via interviews, reviews, and observations.
• Analyze audit findings and present risk recommendations.
• Support continuous monitoring and incident response programs.
• Perform related duties as required.

Skills

IT Audit

Risk Management

Security Standards

Vendor Assessment

Regulatory Compliance

Job description

ABOUT THE ROLE

The SCC’s Health Benefit Exchange division is seeking an experienced IT auditor to support our transition to a new security standard and strengthen our third-party risk management program. This role will help interpret and implement updated security requirements, conduct audits and assessments of both internal processes and external vendors and partners evaluating controls and recommending improvements.

Responsibilities Include:

• Assess current security controls and processes against new CMS, IRS, and SCC security standards.
• Identify gaps and recommend remediation steps to achieve and maintain compliance.
• Plan, lead, and execute development and updates to policies, procedures, and documentation to reflect requirements.
• Design, implement, and train on the process for assessing partners and vendors, ensuring alignment with security standards.
• Develop assessment tools, workflows, and scoring model to evaluate and measure the effectiveness and compliance of vendor and partner security controls.
• Evaluate the security posture of vendors and partners to ensure information security contractual, information sharing, and data sharing agreement requirements are met.
• Test the effectiveness of operational and management controls using interviews, document reviews, and observation.
• Analyze, assess, report, and present on audit findings, risk exposure, and recommendations.
• Support information security continuous monitoring and incident response programs.
• Perform related work as required.