Information Systems Auditor

Travis County•Austin, TX

1d•Hybrid

About The Position

Travis County Technology and Operations is hiring an Information Systems Auditor in the Enterprise Risk Management Division. The position performs advanced information security, compliance, risk management, and audit work in support of the County’s Information Assurance and cybersecurity programs. It serves as a senior-level subject matter resource for information security compliance, with significant responsibility for supporting the County’s Criminal Justice Information Services (CJIS) compliance program and evaluating compliance with the FBI CJIS Security Policy. The role plans and conducts technical and administrative security assessments and audits; evaluates security controls; identifies compliance gaps and risks; develops findings and recommendations; and monitors remediation. It assists County departments in interpreting and implementing CJIS, NIST, HIPAA, County policy, and other applicable regulatory or contractual requirements. The auditor evaluates administrative, technical, and physical safeguards protecting County systems and information, and reviews configurations, policies, procedures, access controls, security architecture, audit records, and other evidence to assess whether controls are designed and operating as intended. The position develops assessment methodologies, audit procedures, control checklists, compliance documentation, risk reports, and executive summaries. It collaborates with County departments, IT and information security personnel, departmental security representatives, management, vendors, auditors, and external agencies. The role may lead projects, mentor or guide staff, and represent the department in meetings. The position is eligible for teleworking, with in-office work as needed, and may require a flexible schedule to meet operational or audit requirements. Work is primarily performed in an office, onsite or in a secure hybrid/telework environment, with occasional visits to data centers, agency offices, or vendor locations. The employee must follow strict security protocols, including physical access controls, fingerprint-based background checks, and secure-area clearances. Occasional work outside normal business hours may be necessary for security incidents or deadlines. The role supports business continuity efforts as assigned.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Business Administration, or a directly related field and five years of relevant work experience in IT auditing or an IT role with significant exposure to internal controls and risk assessment practices; or an equivalent combination of education and experience sufficient to perform the duties.
Valid Texas Driver’s License.
Knowledge of information security governance, risk management, compliance, and audit principles and practices.
Knowledge of FBI CJIS Security Policy requirements and controls for systems that access, process, store, or transmit Criminal Justice Information.
Knowledge of NIST cybersecurity standards and frameworks, including NIST SP 800-53, NIST AI RMF, and NIST CSF 2.0.
Knowledge of applicable federal, state, local, and County laws, regulations, policies, standards, and contractual requirements for information security and privacy, including HIPAA.
Knowledge of information security audit methodologies, evidence collection, control testing, sampling, workpapers, findings, and corrective-action monitoring.
Knowledge of IT risk assessment and risk management methodologies, including qualitative and quantitative approaches.
Knowledge of security control design, implementation, assessment, monitoring, and remediation.
Knowledge of data protection, including encryption, cryptographic controls, data classification, data loss prevention, removable media protection, transmission security, and secure disposal.
Knowledge of third-party and vendor cybersecurity risk management, cloud and SaaS security, and shared responsibility models.
Knowledge of security policy, standards, procedure, guideline, and technical documentation development.
Knowledge of communicating technical, security, risk, and compliance information to technical and non-technical audiences.
Knowledge of computer equipment and word processing, spreadsheets, databases, and other software packages.
Skill in conducting security audits, compliance assessments, control assessments, and IT risk assessments.
Skill in interpreting and applying cybersecurity frameworks, regulatory requirements, policies, standards, and technical requirements.
Skill in evaluating administrative, technical, and physical controls and determining whether evidence demonstrates compliance.
Skill in identifying control deficiencies, analyzing risk and root causes, and developing practical corrective-action recommendations.
Skill in developing audit workpapers, assessment documentation, findings, risk statements, corrective-action plans, and executive-level reports.
Skill in collecting, reviewing, analyzing, and documenting technical and administrative evidence.
Skill in researching cybersecurity requirements and applying them to complex IT environments.
Skill in managing multiple assessments, audits, findings, and remediation activities simultaneously.
Skill in explaining complex technical and regulatory requirements clearly to technical and non-technical audiences.
Skill in providing consultation, guidance, training, and technical assistance to County departments and stakeholders.
Ability to interpret complex cybersecurity policies, standards, laws, regulations, and contractual requirements and translate them into measurable controls and operational requirements.
Ability to independently plan, organize, conduct, document, and report security audits, assessments, and risk analyses.
Ability to evaluate evidence objectively and determine whether controls are appropriately designed, implemented, and operating effectively.
Ability to identify and clearly articulate deficiencies, compliance gaps, risks, and recommended corrective actions.
Ability to apply CJIS requirements to diverse technical environments, business processes, County departments, and information systems.
Ability to communicate audit findings and security risks professionally and effectively.
Ability to work collaboratively with technical staff, departmental leadership, auditors, vendors, legal counsel, risk management personnel, and governmental entities.
Ability to maintain independence, objectivity, confidentiality, and professional judgment in audits and assessments.
Ability to manage complex assignments, competing priorities, deadlines, and accurate compliance documentation.
Ability to research, compile, analyze, interpret, and present complex technical and regulatory information.
Ability to develop practical recommendations that balance security and compliance requirements with operational needs.
Ability to provide guidance, mentoring, and technical assistance to staff and maintain effective stakeholder relationships.
Ability to work independently with limited supervision and contribute to multidisciplinary teams.

Nice To Haves

Certified Information Systems Auditor (CISA).
Certified Information Security Professional (CISSP).
Certified Risk and Information Systems Control (CRISC).
Global Information Assurance Certification (GIAC) certifications from SANS.

Responsibilities

Plan, conduct, document, and report information security compliance assessments, technical and administrative audits, and risk assessments of County departments, systems, applications, processes, and third-party services.
Support administration of the County’s CJIS compliance program and evaluate compliance with applicable FBI CJIS Security Policy requirements.
Conduct CJIS compliance assessments and internal audits of departments and systems that access, process, store, transmit, or support Criminal Justice Information.
Develop and maintain audit methodologies, assessment procedures, evidence requirements, control checklists, questionnaires, workpapers, and compliance documentation.
Coordinate audit preparation and evidence collection with County departments, IT personnel, security representatives, management, vendors, and other stakeholders.
Review policies, procedures, system configurations, access controls, security documentation, audit logs, system architecture, data flows, training records, personnel security documentation, incident response processes, physical safeguards, and other evidence.
Document findings, identify control deficiencies and associated risks, recommend corrective actions, and communicate results to technical personnel, departmental management, and executive leadership.
Develop, track, and monitor corrective action plans, POA&Ms, risk treatment activities, exceptions, and other remediation efforts; conduct follow-up assessments to validate corrective actions.
Help County departments interpret CJIS requirements and translate them into practical administrative, technical, and operational controls.
Support external CJIS audits and assessments by coordinating evidence collection, reviewing documentation, facilitating interviews, responding to audit requests, documenting findings, and monitoring corrective actions.
Conduct IT and cybersecurity risk assessments using qualitative and quantitative methodologies, including assessments of systems, applications, technology services, vendors, business processes, and control deficiencies.
Evaluate administrative, technical, and physical security controls against applicable laws, regulations, contractual requirements, County policies, and cybersecurity frameworks and standards.
Review proposed and existing technologies for security, privacy, regulatory, and compliance risks and recommend safeguards and risk treatment measures.
Develop and maintain information security policies, standards, procedures, guidelines, assessment methodologies, and supporting documentation.
Analyze changes to the FBI CJIS Security Policy and other cybersecurity requirements and assess their impact on County systems, departments, policies, procedures, and controls.
Prepare technical reports, risk assessments, audit and compliance reports, dashboards, presentations, executive summaries, and other documentation about risks, findings, remediation, and compliance posture.
Collaborate with information security, IT, privacy, legal, risk management, departmental personnel, and external organizations on cybersecurity risk and compliance matters.
Provide consultation, guidance, training, and awareness to County departments on information security requirements, CJIS responsibilities, security controls, and audit readiness.
Participate in security governance, risk management, compliance, incident response, business continuity, and other Information Assurance initiatives.
May lead projects, mentor staff, review other analysts’ work, and provide technical or compliance guidance to junior staff.
Perform other job-related duties as assigned.