Information Systems Auditor (Auditor IV)

We are seeking candidates with significant, demonstrable experience in IT auditing and data analytics. This person should have experience in planning and conducting information systems audits of IT infrastructure, applications, security protocols, and data management practices to ensure compliance with regulatory requirements, internal policies, information technology contract requirements and industry standards.

The position works as an auditor with various departments and county IT professionals to gather information regarding the IT infrastructure, applications, and/or policies and standards. Performs detailed risk assessments of information systems and technology, conducting control testing to ensure adherence to established security policies, and evaluating the design and operating effectiveness of key IT controls. Provides practical insights and recommendations for improvement in application design, functionality, security, performance and leveraging new technologies such as Gen AI effectively. Lastly, could serve as a technical consultant and provide advice on internal controls for current and planned IT systems and applications.

The auditor should have general business knowledge as they will also work on operational audits in areas such as revenue and purchasing, management advisory services, and investigations. Additionally, should be proactive in maintaining specialized technical expertise and staying informed of emerging IT risks, technologies, and changes affecting information technology and auditing standards.

The position provides the Internal Audit Office staff with support on help desk issues, implementing new county application tools, performing system administrator duties for audit management software and ensuring the office complies with county information security requirements.

The successful candidate must have the ability to build strong working relationships, collaborate with individuals with diverse knowledge of information technology, stay up to date on new technologies affecting the county, and effectively present results concisely and descriptively through verbally and written reports containing data visualization to all levels of management.

Note: This position is eligible for scheduled telework as permissible by the county telework policy which allows for a hybrid environment of in office and telework days.

(The illustrative duties listed in this specification are representative of the class but are not an all inclusive list. A complete list of position duties and unique physical requirements can be found in the position description.)

• Acts as consultant in systems planning, design, and implementation ensuring effective use of control techniques and efficient use of resources;
• Plans the scope of an audit, performs risk assessment, and develops a risk-based fieldwork audit program;
• Evaluates procedures and preparations for system backup and reconstruction, and business continuity;
• Examines and analyzes automated files, records, and other documentation of existing
• systems to determine accuracy and compliance with County policies, procedures, and standards;
• Tests transactions and reviews system specifications to ensure that controls are adequate and operational;
• Advises Internal Audit staff in uses and techniques of the computer as an audit tool;
• Presents oral and written reports to management, communicating findings and recommendations;
• Plans and conducts all phases of computer system audits (of both hardware and software), including security, data integrity, and industry standards;
• Analyzes complex department operations for efficiency, effectiveness, and compliance with policies and procedures;
• Conducts investigative audits to examine allegations of fraud, waste, and abuse;
• Evaluates department responses to audit reports;
• Performs assigned follow-up audits of department action plans;
• Performs quality control reviews of other staff members' workpapers.
• Directs, monitors, and supervises assigned audits and projects;
• Counsels and guides lower level auditors on assigned projects;

(The knowledge, skills and abilities listed in this specification are representative of the class but are not an all inclusive list.)

• Thorough knowledge of computer data and system security;
• Thorough knowledge of the design and testing of computer applications controls;
• Thorough knowledge of client server, Windows, and network controls;
• Thorough knowledge of information systems general controls;
• Thorough knowledge of data extraction and analysis software tools;
• Thorough knowledge of internal auditing standards, procedures, techniques, and internal control;
• Thorough knowledge of governmental accounting principles, methods, and practices;
• Thorough knowledge of management principles, methods, and practices;
• Ability to effectively use personal computers and common software, i.e., word processing, spreadsheet, and flowcharting;
• Ability to establish and maintain effective working relationships;
• Ability to problem solve and analyze complex County operations;
• Ability to plan work, develop audit methodology, and complete assignments within established deadlines;
• Ability to work independently within established policies, procedures, and guidelines;
• Ability to communicate clearly and concisely both orally and in writing with all levels, including senior management.

MINIMUM QUALIFICATIONS:
Any combination of education, experience, and training equivalent to the following:
(Click on the aforementioned link to learn how Fairfax County interprets equivalencies for "Any combination, experience, and training equivalent to")
Graduation from an accredited four-year college or university with a bachelor's degree in business administration, public administration, information systems, or related a field with major course work in accounting, auditing, finance, information systems and/or computer science;
plus four years of professional experience in information systems or auditing.

CERTIFICATES AND LICENSES REQUIRED:
MUST POSSESS ONE OF THE FOLLOWING:

• Certified Information Systems Auditor (CISA);
• Certified Information Security Manager (CISM);
• Certified in Risk and Information Systems Control (CRISC);
• Certified Information Systems Security Professional (CISSP);
• Certified in Governance, Risk and Compliance (CGRC);
• Certified Cloud Security Profession (CCSP) Microsoft Certified;
• Power BI Data Analyst Associate;
• or CompTIA Data Analytics Plus Certification.

• 2-3 years of information systems auditing experience.
• Government auditing experience.
• Strong communication skills and experience writing official correspondence and memoranda, preparing presentations, preparing official written reports, and leading and/or facilitating meetings.
• Strong computer skills including high proficiency with Electronic Workpapers/Automated workflow systems, Microsoft Office Suite applications including Excel, Word, Outlook, SharePoint, and MS Teams.
• Experience in performing data analytics.
• Ability to work effectively with minimal supervision and prioritize multiple tasks.
• Experience and ability to analyze complex IT processes and to determine the efficiency and effectiveness of the process and related control.

Fairfax County is home to a highly diverse population, with a significant number of residents speaking languages other than English at home (including Spanish, Asian/Pacific Islander, Indo-European, and many others.) We encourage candidates who are bilingual in English and another language to apply for this opportunity.