Remote IT Auditor & Risk Assessor (Contract)

Vaco; Columbus (OH); On-site; USD 60,000 - 90,000; Part time

Job summary

Vaco is seeking a Contract IT Auditor / Risk Assessor to lead IT risk and control assessments. The role combines IT audit discipline with GRC experience and requires collaborating with infrastructure, cybersecurity, and operations teams during EST business hours.

You will document testing procedures, evidence, gaps, and remediation steps, coordinate with control owners, and help move approved risks into the GRC platform.

Qualifications

• 5+ years of IT audit, risk, or compliance experience.
• Experience conducting IT control assessments from evidence to conclusions.
• Ability to work with technical owners and IT leadership.
• Strong written documentation and testing skills.
• Comfort with remote work during Eastern Time hours.

Responsibilities

• Execute risk and control assessments across prioritized IT risk areas.
• Translate control descriptions into practical assessment activities.
• Engage appropriate Control Owners or SMEs.
• Explain control purpose, risk, and evidence requirements.
• Collect, organize, and evaluate evidence (policies, reports, access reviews, tickets, logs).
• Assess control design and operation; identify gaps and issues.
• Document testing procedures, evidence, results, and remediation.
• Coordinate with stakeholders and upload results into the GRC platform.
• Train Control Owners for future assessments and evidence submission.
• Support PCI/FDIC-related requests as needed.

Skills

IT audit

GRC

auditing evidence collection

stakeholder communication

remote collaboration

Education

CISA, CISSP, CRISC, CIA, CISM (certs)

Tools

ServiceNow GRC

Archer

AuditBoard

OneTrust

LogicGate

Job description

Vaco is seeking a Contract IT Auditor / Risk Assessor to lead IT risk and control assessments. The role combines IT audit discipline with GRC experience and requires collaborating with infrastructure, cybersecurity, and operations teams during EST business hours.

You will document testing procedures, evidence, gaps, and remediation steps, coordinate with control owners, and help move approved risks into the GRC platform.