IT Audit Specialist

General Description

Their responsibility is to evaluate and ensure the effectiveness, security, and compliance of College Computing information technology systems, processes, and controls. This role is a core Security Operations and Risk Architecture position focused on strengthening infrastructure resilience and system integrity. Their work is essential for safeguarding digital assets, maintaining regulatory compliance, and identifying areas of improvement within IT infrastructure. The role supports regular system access reviews and drives the human‑defense layer via continuous security training.

By optimizing incident response playbooks and managing technical third‑party risk, this position is vital for neutralizing vulnerabilities, minimizing downtime, and proactively engineering a more secure IT infrastructure.

• Ensure IT operations comply with relevant laws, regulations, and standards (e.g., GDPR, HIPAA, FERPA, NIST CSF).
• Collaborate with technical teams to validate controls, collect evidence, and maintain the official Compliance Tracker.
• Perform third‑party and supplier risk assessments, document findings, and support risk mitigation activities.
• Collaborate on BIA and risk assessments to align system recovery objectives with operational requirements and continuity profiles.
• Orchestrate automated security training workflows on the KnowBe4 platform and analyze engagement metrics to reduce human‑centric risk.
• Execute controlled social engineering tests with Microsoft Attack Simulator to harden email security filters and user response protocols.
• Update and standardize incident response playbooks in alignment with NIST CSF; ensure quarterly reviews and accessibility for stakeholders.
• Facilitate technical tabletop exercises to identify process bottlenecks and document lessons learned to optimize response speed.
• Review and evaluate Active Directory to enforce the Principle of Least Privilege (PoLP) and remediate unauthorized access paths.
• Conduct internal assessments of CIS Controls and utilize the CSAT tool to measure control maturity and drive technical roadmap improvements.
• Develop and maintain a centralized dashboard to track security control health and document verification of safeguards.
• Manage the remediation pipeline, coordinating with cross‑functional teams to patch security gaps and close open vulnerabilities.

• Knowledge of IT infrastructure, networks, applications, and cybersecurity principles.
• Demonstrated analytical skills and attention to detail in reviewing processes, documentation, and managing evidence.
• Ability to produce clear, concise reporting for both technical and non‑technical stakeholders.
• Capability to collaborate with technical teams to validate controls, collect evidence, and maintain the official Compliance Tracker.
• Experience managing and maintaining audit documentation and evidence repositories for internal and external reviews.
• Ability to identify potential vulnerabilities and risks; contribute to Business Impact Analysis (BIA) and risk assessments.
• Experience with major security frameworks (e.g., NIST CSF, CIS Controls).
• Experience in IT audit, security, risk management, or compliance.
• Experience with Microsoft Office.

• Professional certification such as CISA (Certified Information Systems Auditor).

May be required to perform other duties as assigned. May be required to assist the agency or state government generally in the event of an emergency declaration by the Governor.

In support of the Commonwealth’s commitment to inclusion, we encourage individuals with disabilities to apply through the Commonwealth’s Alternative Hiring Process. To be considered for this opportunity, applicants must provide their AHP Letter (formerly called a Certificate of Disability) from the Department of Aging & Rehabilitative Services (DARS) or the Department of the Blind & Vision Impaired (DBVI). Service‑Connected Veterans may also apply via the AHP if they provide an AHP Letter.

To request an AHP Letter, use this link: https://(Use the "Apply for this Job" box below). or call DARS at…