IT Audit Liaison

Location: Harrisburg, PA
Work Arrangement: Hybrid - 60% Onsite / 40% Remote
Interview: Virtual
Contract: 08/24/2026 - 12/31/2026. Historically, these roles are extended for an additional year.
Visas Accepted: USC, GC, GC EAD, H1B

Role Overview

Under the direction of the IT Governance, Risk and Compliance Manager, this position serves as an IT Audit Liaison within the Enterprise Information Security Office (EISO), supporting the Commonwealth's Governance, Risk, and Compliance (GRC) Department. The IT Audit Liaison provides technical audit and compliance support for the organization's Governance, Risk, and Compliance (GRC) program. The position is hybrid - 3 days in the office/2 days remote at Forum Building | 607 South Drive | Harrisburg, PA 17120.

Primary Responsibilities

• Coordinates and supports information technology audits conducted by internal and external oversight organizations, including GAAP/Single Audit, the Pennsylvania Auditor General, Attorney General, Bureau of Audits, and other regulatory entities.
• Assists in developing audit procedures, compliance documentation, metrics, and management reports.
• Participates in continuous improvement initiatives related to governance, risk management, and internal controls.
• Performs related work as assigned.

Required Technical Skills

• Evaluates information security and technology controls against established frameworks, including NIST Cybersecurity Framework (CSF), NIST Special Publication 800-53, ISO 27001, and Commonwealth security policies.
• Identifies control deficiencies, documents findings, and recommends corrective actions to reduce organizational risk.
• Assists business and technical stakeholders in preparing audit responses and collecting supporting evidence.
• Tracks audit findings, validates corrective actions and reports remediation status and residual risk to management.
• Supports development and maintenance of automated workstreams for audit management, compliance tracking, and evidence collection.
• Develops dashboards, metrics and executive reports regarding audit trends, compliance posture and remediation progress.
• Performs risk-based assessments to prioritize audit activities and evaluate control effectiveness.
• Reviews documentation and technical evidence to determine compliance with applicable laws, regulations, policies, and security standards.

Preferred Qualifications

• Cybersecurity governance and risk management
• NIST CSF, NIST 800-53, ISO 27001, and related frameworks
• Professional certification such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM) or equivalent
• Experience supporting IT audits, regulatory examinations or compliance assessments