Job Summary:
The IT Audit Supervisor leads and oversees the DMAS RightFax security audit, ensuring technical quality, independence, and compliance with relevant standards. This role involves managing audit execution, reviewing findings, coordinating communications, and approving deliverables to meet regulatory and client requirements.
Responsibilities:
- Lead audit mobilization, independence confirmation, entrance conference planning, and scope alignment.
- Oversee development and coverage of the audit program against Appendix A controls and DMAS/VITA boundaries.
- Ensure engagement compliance with SEC530-01.2, SEC502-05, SEC520-06, NIST SP 800-53 Revision 5, and GAGAS Yellow Book standards.
- Direct and review IT Auditor activities including interviews, walkthroughs, sampling, testing, and documentation.
- Perform quality reviews to validate conclusions and ensure findings include condition, criteria, cause, effect, and recommendations.
- Lead discussions with DMAS stakeholders on findings and oversee management response collection.
- Manage weekly status reports, stakeholder meetings, schedule and risk monitoring, and escalate issues within 24 hours.
- Approve draft and final reports, exit conference materials, and complete editable workpaper packages before delivery.
Required Skills & Certifications:
- Minimum five years of IT audit experience including supervision, review, or engagement leadership.
- Strong knowledge of VITA security standards or NIST SP 800-53.
- Proven ability to supervise IT security audits in government or regulated environments.
- Expertise in audit planning, risk-based scoping, quality control, finding development, corrective action review, and executive communication.
- Ability to evaluate audit sufficiency, evidence reliability, control applicability, and professional standards compliance.
- Capability to coordinate multiple stakeholders while maintaining auditor independence and objectivity.
- CISA certification or equivalent IT audit certification (e.g., CIA, CISSP, CRISC, GSNA accepted by DMAS).
- Experience leading Commonwealth of Virginia IT security audits.
- Experience supporting audit organizations under GAGAS peer review with a "generally conforms" opinion.
- Experience delivering fixed-price, milestone-based audits with editable reports and workpapers.
Preferred Skills & Certifications:
- Additional certifications such as CIA, CISSP, CRISC, or GSNA recognized by DMAS as equivalent to CISA.
- Experience working within Commonwealth of Virginia IT security frameworks.
Special Considerations:
- Must confirm and maintain auditor independence throughout the engagement.
- Engagement conducted in accordance with strict regulatory and government auditing standards.
- Remote work mode available; client visits scheduled as needed.
Scheduling:
- Flexible remote work with client site visits scheduled when required.
- Responsible for managing weekly status reporting and meetings.
- Timely escalation of issues within 24 hours is mandatory.