IT Audit Liaison
*This is a hybrid role requiring 3 days/week onsite.
*Local to the Harrisburg, PA area only, please.
Description:
- Under the direction of the IT Governance Risk and Compliance Manager this position serves as an IT Audit Liaison.
- The GRC function provides governance risk evaluation and compliance oversight to support informed decision-making and the responsible adoption of technology across the Commonwealth.
The IT Audit Liaison provides technical audit and compliance support for the organization’s Governance Risk and Compliance GRC program. - The employee participates in internal and external audit activities evaluates the effectiveness of information technology controls identifies compliance gaps and supports remediation efforts to strengthen the organization’s cybersecurity and regulatory compliance posture.
Responsibilities:
- Coordinates and supports information technology audits conducted by internal and external oversight organizations including GAAP/Single Audit the Pennsylvania Auditor General Attorney General Bureau of Audits and other regulatory entities.
- Reviews documentation and technical evidence to determine compliance with applicable laws regulations policies and security standards.
- Evaluates information security and technology controls against established frameworks including NIST Cybersecurity Framework CSF NIST Special Publication 800-53 ISO 27001 and Commonwealth security policies.
- Identifies control deficiencies documents findings and recommends corrective actions to reduce organizational risk.
- Assists business and technical stakeholders in preparing audit responses and collecting supporting evidence.
- Tracks audit findings, validates corrective actions, and reports remediation status and residual risk to management.
- Supports development and maintenance of automated workstreams for audit management compliance tracking and evidence collection.
- Develops dashboards metrics and executive reports regarding audit trends compliance posture and remediation progress.
- Performs risk-based assessments to prioritize audit activities and evaluate control effectiveness.
- Assists in developing audit procedures compliance documentation metrics and management reports.
- Participates in continuous improvement initiatives related to governance risk management and internal controls.
- Performs related work as assigned.
Required Skills/Knowledge/Experience:
- Evaluates information security and technology controls against established frameworks, including NIST Cybersecurity Framework (CSF), NIST Special Pu, Required
- Identifies control deficiencies, documents findings, and recommends corrective actions to reduce organizational risk, Required
- Assists business and technical stakeholders in preparing audit responses and collecting supporting evidence., Required
- Tracks audit findings, validates corrective actions and reports remediation status and residual risk to management., Required
- Supports development and maintenance of automated workstreams for audit management, compliance tracking, and evidence collection., Required
- Develops dashboards, metrics and executive reports regarding audit trends, compliance posture and remediation progress. , Required
- Performs risk-based assessments to prioritize audit activities and evaluate control effectiveness., Required
- Reviews documentation and technical evidence to determine compliance with applicable laws, regulations, policies, and security standards. , Required
- Cybersecurity governance and risk management, Highly desired
- NIST CSF, NIST 800-53, ISO 27001, and related frameworks, Highly desired
Preferred Qualifications:
- Professional certification such as Certified Information Systems Auditor CISA Certified in Risk and Information Systems Control CRISC Certified Information Security Manager CISM or equivalent
- Experience supporting IT audits regulatory examinations or compliance assessments
- Information technology auditing principles and practices
- Cybersecurity governance and risk management
- Internal controls and compliance concepts
- NIST CSF NIST 800-53 ISO 27001 and related frameworks
- IT infrastructure applications cloud technologies and security controls
- Ability to: Analyze technical and audit documentation
- Evaluate compliance with policies and standards
- Prepare clear reports and recommendations
- Communicate effectively with technical and non-technical staff
- Organize multiple audit activities simultaneously
Proper email communication will only be done to and from @astyra.com email addresses. Please ensure you are communicating with approved Astyra recruiters by checking this point when receiving offers and messages from us. Please ensure you are communicating within these guidelines and proper channels for the quickest possible interview consideration!
#AC