IT Audit Supervisor

The IT Audit Supervisor is responsible for overseeing and coordinating the DMAS MFT System Security Audit, ensuring compliance with DMAS, VITA, NIST, and GAGAS standards. This role leads audit planning, supervises evidence collection and testing, reviews work papers, validates findings, and manages stakeholder communications to deliver comprehensive and accurate audit reports.

• Lead the entrance conference to confirm audit scope, limitations, and timelines.
• Develop and obtain approval for the audit program covering Appendix A controls.
• Supervise evidence collection, testing, and documentation performed by IT auditors.
• Review work papers for completeness, accuracy, and sufficiency of evidence.
• Validate findings and ensure all five elements of each finding are met before release.
• Lead weekly status reporting and meetings to discuss progress, issues, and risks.
• Prepare draft and final audit reports, including corrective action plans.
• Lead the exit conference and confirm delivery of complete and accessible work papers.
• Maintain auditor independence and safeguard sensitive audit information.

• Minimum 5+ years of IT audit experience, including audit supervision.
• Strong knowledge of VITA Standards (SEC
  530-01.2, SEC
  502-05, SEC
  520-06) and NIST SP 800-53 Rev. 5 control assessment.
• Familiarity with GAGAS (Yellow Book) audit requirements.
• Expertise in audit planning, risk-based scoping, quality assurance review, findings development, root cause analysis, and report writing.
• Strong senior stakeholder communication skills with IT, security, and internal audit leaders.
• CISA certification strongly preferred; similar certifications such as CISSP, CIA, CRISC, or CISM are also acceptable.

• Experience leading IT security compliance audits at Commonwealth of Virginia agencies.
• Experience with GAGAS engagements subject to peer review.
• Bachelor s degree in Information Systems, Cybersecurity, Accounting, or a related field.

• Maintain strict auditor independence throughout the audit process.
• Protect sensitive and confidential audit information at all times.

• Work schedule and shift patterns are not specified; likely standard business hours with possible additional meetings as needed.