IT Audit Consultant

3.       Position Description and Job Skill Set

Description of the job functions the contractor will be expected to perform.

The contractor willprovide audit and compliance support services to assist withpreparing for, responding to, and tracking internal and external audits. The contractor will coordinate with agency personnel, technical staff, and documentation resources to ensure audit requirements are addressed accurately and timely.

Primary responsibilities include:

• Assist withplanning, coordinating, and supporting information technology audits.
• Prepare and coordinate auditresponses and evidence submissions.
• Assist with development and tracking of: Corrective ActionPlans, Plans of Action and Milestones, Safeguard and Security Reports, security assessment responses, audit status reports.
• Track audit findings through remediation andclosure.
• Coordinate with business unitsand technical staffto obtain supporting documentation.
• Identify documentation gaps and work with otherstaff to facilitate development or revision of policies, standards, procedures, and other governance documentation.
• Review submitted evidence for completeness, consistency, and compliance.
• Monitor remediation activities and provide statusreporting to management
• Assist with implementation and documentation of corrective actions.
• Maintain audit documentation repositories.
• Support periodic compliance assessments and internal reviews.
• Assist withrisk assessments and compliance reporting.

Required Skills/Experience

Provide the minimum required skills and/or experience the contractor must possess to qualify for this position. These requirements willbe transferred to the ScoreSheet and candidates without these requirements reflected on theirresume will

NOT be presented to the manager for consideration.

Demonstrated knowledge with several of the following:

• Information security governance
• IT audit processes
• Risk management
• Control assessments
• NIST Cybersecurity Framework
• Nist SP 800-53
• IRS Publication 1075
• Corrective ActionPlans (CAPs)
• Plans of Actionand Milestones (POA&Ms)
• Audit evidence collection
• Compliance collection
• Compliance documentation
• Security control implementation

Preferred/Not Required

Provide any skills/experience thatwould be helpfulfor the candidate to possess but not required. Examples: Previous supervisory

experience, WebLogic experience helpful, etc.

• Experience supporting IRS,SSA, or OSA audits andresponses.
• CISA, CGRC, CISSP,CRISC, Security+, or equivelant certifications.