IT Security Auditor - Vendor Risk & Compliance Lead

STI; Richmond (VA); On-site; USD 90,000 - 120,000; Full time

Job summary

SCC Health Benefit Exchange is seeking an experienced IT Auditor in Richmond, VA to support the transition to a new security standard and strengthen third-party risk management. This on-site role requires auditing and evaluating controls across vendors and partners to ensure compliance.

The position involves designing assessment tools, guiding policy updates, and leading audits to identify gaps and remediation steps, with interviews and document reviews forming part of the process.

Qualifications

• Experience interpreting and implementing updated security requirements.
• Assess current security controls and processes against CMS, IRS, and SCC security standards.
• Identify gaps and recommend remediation steps to achieve and maintain compliance.
• Plan, lead, and execute development and updates to policies, procedures, and documentation to reflect requirements.
• Design, implement, and train on the process for assessing partners and vendors, ensuring alignment with security standards.
• Develop assessment tools, workflows, and scoring model to evaluate and measure the effectiveness and compliance of vendor and partner security controls.
• Evaluate the security posture of vendors and partners to ensure information security contractual, information sharing, and data sharing agreement requirements are met.
• Test the effectiveness of operational and management controls using interviews, document reviews, and observation.
• Analyze, assess, report, and present on audit findings, risk exposure, and recommendations.
• Support information security continuous monitoring and incident response programs.
• Perform related work as required.

Responsibilities

• Assess current security controls and processes against CMS, IRS, and SCC security standards.
• Identify gaps and recommend remediation steps to achieve and maintain compliance.
• Plan, lead, and execute development and updates to policies, procedures, and documentation to reflect requirements.
• Design, implement, and train on the process for assessing partners and vendors, ensuring alignment with security standards.
• Develop assessment tools, workflows, and scoring model to evaluate and measure the effectiveness and compliance of vendor and partner security controls.
• Evaluate the security posture of vendors and partners to ensure information security contractual, information sharing, and data sharing agreement requirements are met.
• Test the effectiveness of operational and management controls using interviews, document reviews, and observation.
• Analyze, assess, report, and present on audit findings, risk exposure, and recommendations.
• Support information security continuous monitoring and incident response programs.
• Perform related work as required.

Job description

SCC Health Benefit Exchange is seeking an experienced IT Auditor in Richmond, VA to support the transition to a new security standard and strengthen third-party risk management. This on-site role requires auditing and evaluating controls across vendors and partners to ensure compliance.

The position involves designing assessment tools, guiding policy updates, and leading audits to identify gaps and remediation steps, with interviews and document reviews forming part of the process.