Senior Internal IT Auditor (Hybrid)

State Corporation Commission; Richmond (VA); Hybrid; USD 110,000 - 140,000; Full time

Job summary

State Corporation Commission in Richmond, Virginia seeks a Senior Information Technology Auditor to plan, conduct, and report on complex IT, cybersecurity, and compliance audits. The role is based in Richmond with a hybrid schedule (2 remote, 3 in-office days weekly) and covers full audit lifecycles from risk assessment through reporting findings and management recommendations.

The ideal candidate will independently perform full lifecycle IT audit engagements, conduct walkthroughs, data

Qualifications

• Experience leading full lifecycle IT audits (planning, fieldwork, reporting).
• Strong ability to map controls to business processes and identify gaps.
• Familiarity with IT governance, risk management, and regulatory requirements.
• Ability to communicate findings clearly to management and foster independence.

Responsibilities

• Plan and conduct IT, cybersecurity, and operational audits.
• Perform risk assessments, control evaluations, and testing.
• Develop actionable recommendations and manage reporting to management.
• Maintain objectivity and professional skepticism throughout engagements.

Skills

IT audit

Risk assessment

Control evaluation

Reporting

Walkthroughs

Interviews

Data analysis

Testing

Governance & risk management

Independence & objectivity

Tools

NIST 800-53

Job description

The State Corporation Commission's Office of Internal Audit seeks a Senior Information Technology Auditor to plan, conduct, and report on complex IT, cybersecurity, and operational compliance audits in accordance with professional standards. The role is based in Richmond, Virginia on a hybrid schedule (2 remote, 3 in-office days weekly) and involves the full lifecycle of IT audit engagements from risk assessment through reporting findings and recommendations to management.

Key qualifications:

• Independently perform full lifecycle IT audit engagements including risk assessment, planning, control evaluation, and reporting
• Conduct walkthroughs, interviews, data analysis, and testing to evaluate design and operating effectiveness of internal controls
• Identify root causes, business impacts, and practical recommendations to strengthen governance and risk management
• Monitor Virginia Information Technology Agency SEC 530 (NIST 800-53) and audit legislation
• Foster collaborative relationships while maintaining organizational independence and objectivity