IT Auditor /Government & risk compliance consultant

IT Auditor / Government & Risk Compliance ConsultantJob location-Richmond/McLean VA (Hybrid)Role is surrounding a continuous controls monitoring program that they're trying to stand up within cybersecurity. They're looking to build out what will be many audits of controls (understanding how the controls operate, reviewing controls, setting requirements, etc.) and establishing where the data resides and how to build out requirements for the data analyst. Issues with candidates so far - lots of folks with tech compliance where it seems like they understand how to gather evidence for controls but don't understand how to set the requirements for evidence gathering for controls.

They have step 2 (gathering evidence) but not step 1 (setting requirements on how to gather evidence, etc.)Skills Required:Bachelors Degree5+ years of experience in technology audit, compliance, or governance & risk management2+ years of experience with cloud environments2+ years of experience in an agile or scrum environmentCISA, CISM, Security+, CISSP, CEH, CCSP, or AWS CertificationExperience with regulatory requirements and control frameworks (e.g., SOX, COSO, COBIT)Experience developing and implementing a continuous controls monitoring programProblem-solving and decision-making skills, with the ability to analyze complex issues and develop practical solutionsDemonstrated ability to manage multiple projects simultaneously, prioritize tasks, and meet deadlines in a fast-paced environmentSome expertise within controls testing and controls documentationKnowledge of building out reportingAudit experience would be beneficialEvidence gathering + understanding what evidence to gather and setting requirementsExecuting audits, controls testing, and controls documentationResponsibilities:Assist in the development of a controls monitoring strategy to set standards and best practices for control execution, monitoring, alerting, and reportingDeliverable: Build requirements and draft an approved standard for controls monitoringDevelop and implement monitoring procedures and reporting to track control performance, identify gaps/deficiencies, remediate deficiencies within an SLA, and recommend areas for enhancementDeliverable: Develop monitoring procedures and artifacts for in scope controlsCollaborate with cross-functional teams to ensure alignment of control design and execution with controls monitoring requirementsDeliverable: Align control designs and execution to the monitoring procedureBased on monitoring procedures, conduct thorough assessments to evaluate the effectiveness of controls on a periodic basis to ensure execution, accuracy, and qualityDeliverable: Execute the created controls monitoring proceduresEnable reporting to provide timely updates to management on control status, issues, and remediation effortsDeliverable: Productionalize reporting of control execution monitoringActively seek and report on opportunities to strengthen monitoring and reporting processes via automationDeliverable: Define opportunities for automated monitoring and reporting