Senior Internal IT Auditor (Hybrid)

Virginia State Corporation Commission; Richmond (VA); Hybrid; USD 80,000 - 120,000; Full time

Job summary

Virginia State Corporation Commission in Richmond seeks a Senior IT Auditor to plan, conduct, and report on complex IT, cybersecurity, and operational audits in line with professional standards and the SCC's Audit Manual.

This hybrid role requires strong analytical and communication skills, ability to manage multiple audit engagements, and knowledge of SEC 530 and NIST 800-53; CISA/CISSP/CISM or CIA is a plus.

Qualifications

• 4+ years of professional IT audit experience.
• Knowledge of Commonwealth Virginia IT Security Standard SEC530 and/or NIST 800-53.
• Bachelor's degree required or 8 years of direct work experience without a degree.
• Knowledge of federal and state audit laws, rules, and regulations.
• Ability to understand and express ideas clearly, both verbally and in writing.
• Ability to manage multiple audit engagements simultaneously.
• Certification such as CISA, CISSP, CISM, or CIA is a plus.

Responsibilities

• Independently perform the full lifecycle of an IT audit engagement, including risk assessment, planning and scoping, development of audit programs, control evaluation and testing, workpaper documentation, development of findings and recommendations, and communication of results to management.
• Assist in the development of risk-based IT annual and tri-annual plans.
• Perform walkthroughs, interviews, data analysis, and testing to evaluate internal controls.
• Identify root causes, business impacts, and practical recommendations to strengthen governance, risk management, and internal controls.
• Conduct meetings, walkthroughs, entrance conferences, status meetings, and exit conferences with professionalism and confidence.
• Monitor and track identified control deficiencies, CAPs, and remediation timelines.
• Foster collaborative relationships by positioning OIA as a trusted advisor while maintaining independence and objectivity.
• Monitor Virginia IT Agency SEC 530 and other audit legislation; recommend policy and procedure changes.
• Perform other related work as required.

Skills

IT audit

risk assessment

communication

multi-tasking

Education

Bachelor's degree in Accounting, Economics, Finance, Information Systems or related field

Tools

NIST 800-53

SEC 530

Job description

Starting Salary Range: $80,000 - $120,000

The State Corporation Commission’s(“SCC” or “Commission”) Office of Internal Audit seeks a talented and motivated Senior Information Technology(“IT”) Auditor to plan, conduct, and report on complex information technology, cybersecurity, and operational compliance audits in accordance with professional auditing standards and the SCC’s Office of Internal Audit (OIA) Audit Manual plan. This position is based in Richmond, Virginia and operates on a hybrid schedule, including 2 remote and 3 in-office workdays each week (Monday – Friday). The SCC offers career growth and professional development opportunities including on-the-job training, certifications, and designations.

Essential Duties and Responsibilities

• Independently perform the full lifecycle of an IT audit engagement, including risk assessment, planning and scoping, development of audit programs, control evaluation and testing, workpaper documentation, development of findings and recommendations, and communication of results to management
• Assist in the development of risk-based IT annual and tri-annual plans
• Perform walkthroughs, interviews, data analysis, and testing to evaluate the design and operating effectiveness of internal controls
• Identify root causes, business impacts, and practical recommendations that strengthen governance, risk management, and internal controls
• Conduct meetings, walkthroughs, interviews, entrance conferences, status meetings, and exit conferences with professionalism and confidence
• Monitor and track identified control deficiencies, corrective action plans (CAPs), and remediation timelines
• Foster collaborative relationships by positioning OIA as a trusted advisor while maintaining organizational independence and objectivity
• Monitor Virginia Information Technology Agency SEC 530 (NIST800-53) and other audit legislation; and recommend policy and procedure development and/or modification
• Perform other related work as required

Preferred Qualifications

• 4 or more years of professional IT audit experience within an internal or external audit department
• Experience with and in-depth knowledge of Commonwealth of Virginia IT Security Standard SEC530 and/or NIST 800-53.
• Bachelor’s degree in Accounting, Economics, Finance, Information Systems or a related field
• Without a bachelor’s degree, 8 years of direct work experience is required
• Knowledge of federal and state audit laws, rules, and regulations
• Knowledge of IT principles and methods
• Ability to understand and to express ideas clearly, both verbally and in writing
• Ability to manage multiple audit engagements simultaneously
• Ability to collect and analyze data and evaluate processes and systems
• Ability to effectively manage tasks independently and as a member of a team
• Ability to establish and maintain professional working relationships with SCC staff, and representatives of the utilities and the general public.
• Certification such as CISA, CISSP, CISM, or CIA is a plus