IT Risk and Controls Consultant

Guidehouse•Tysons, VA

About The Position

The IT Risk and Controls Consultant supports stakeholder engagement and technical delivery for a Department of Homeland Security client on IT controls audits and assessments, remediation, and related internal control efforts. The client coordinates and monitors internal controls, including assessments under OMB Circular A-123 and FISCAM, and assists program offices with remediation. This role is suited to an IT audit professional who wants to apply that experience as an internal consultant rather than an external auditor. The consultant works directly with clients and organizational stakeholders to conduct IT control assessments, support remediation, and address ad hoc needs. The work also includes assessing financial system modernization environments and application controls for audit readiness and future risks, and preparing communications and materials that promote understanding of internal controls and OMB A-123.

Requirements

Bachelor's degree.
Three or more years of experience in IT controls, audit, assessment, and/or remediation.
Ability to obtain and maintain a Federal or DoD Public Trust; approved Public Trust adjudication is required before onboarding.

Nice To Haves

Master's degree.
Certified Information Systems Auditor (CISA) certification.
Knowledge and experience in IT risk and controls through IT audits, IT control assessments, and IT security reviews.
Working knowledge of IT audit, FISCAM, and relevant federal information assurance laws, regulations, and guidance.
Experience supporting an internal control program.
Experience performing IT audits, OMB Circular A-123 or similar internal control assessments, and/or remediating and implementing IT controls.
Experience testing or remediating access and account management controls, including authorization, provisioning, recertification, and separation.
Experience with segregation of duties risks and conflicts, preventive and detective controls, and the distinction between segregation of duties and least privilege.
Experience with technical account management controls, including password length, complexity, and expiration.
Experience with audit logging and monitoring, including log generation, aggregation and analysis tools, and log monitoring and review.
Experience with configuration management, including baselines, deviations, maintenance, ongoing compliance monitoring, DISA STIGs, and CIS benchmarks.
Experience with change management controls for authorization, development, testing, and deployment.
Experience with contingency planning, including backups, backup testing, and alternate sites.
An active Public Trust or suitability is preferred.

Responsibilities

Perform rigorous IT controls audits and assessments using industry-standard guidance and leading practices.
Conduct walkthrough interviews and communicate with client stakeholders, including system and database administrators.
Request, obtain, review, and analyze artifacts such as security plans, standard operating procedures, system screenshots, and configuration settings.
Evaluate IT controls' design and operating effectiveness using artifacts, guidance, leading practices, and professional judgment.
Document test results consistently and thoroughly so a reviewer can repeat the test and reach the same conclusion.
Summarize and communicate assessment results to client stakeholders, including senior leadership.
Plan and execute day-to-day assessment activities individually and as part of a team.
Work with client personnel to understand control weaknesses, identify root causes, and develop robust remediation plans.
Provide subject matter expertise on IT controls and respond to ad hoc client requests.
Develop documents supporting internal control assessment planning and control identification.
Support corrective action plans to resolve material weaknesses, significant deficiencies, and control deficiencies.
Review financial system modernization production functionality and application controls and provide input on audit readiness.
Assess incremental financial system modernization efforts and in-production and in-development environments for audit readiness and future risks.
Prepare and deliver presentations, briefing materials, standard operating procedures, FAQs, guides, and white papers supporting awareness of OMB A-123 and internal controls.

Benefits

Medical, prescription drug, dental, and vision insurance.
Personal and family sick time and company-paid holidays.
Position may be eligible for a discretionary variable incentive bonus.
Parental leave and adoption assistance.
401(k) retirement plan.
Basic life and supplemental life insurance.
Health Savings Account and dental, vision, and dependent care Flexible Spending Accounts.
Short-term and long-term disability.
Student loan paydown.
Tuition reimbursement, personal development, and learning opportunities.
Skills development and certifications.
Employee referral program.
Corporate-sponsored events and community outreach.
Emergency back-up childcare program.
Mobility stipend.