IT Audit & GRC Analyst

Location: Harrisburg, PA — hybrid (3 days onsite, 2 days remote). Onsite at Forum Building, 607 South Drive, Harrisburg, PA 17120.

About the Role

We are seeking an experienced IT Audit & GRC Analyst to support a large public-sector organization’s Enterprise Information Security Office. This role will work within the Governance, Risk, and Compliance (GRC) function and will focus on IT audits, cybersecurity controls, regulatory compliance, risk assessments, audit remediation, and executive reporting.

Responsibilities

• Coordinate and support internal and external IT audits and regulatory examinations.
• Review technical documentation and audit evidence to determine compliance with applicable laws, policies, regulations, and security standards.
• Evaluate information security and technology controls using NIST CSF, NIST 800-53, ISO 27001, and related security frameworks.
• Identify control deficiencies, document audit findings, and recommend appropriate corrective actions.
• Partner with business and technical teams to prepare audit responses and collect supporting evidence.
• Track audit findings, validate corrective actions, and report remediation status and residual risk to management.
• Support automated workflows for audit management, compliance tracking, and evidence collection.
• Develop dashboards, metrics, and executive-level reports covering audit trends, compliance posture, and remediation progress.
• Perform risk-based assessments to prioritize audit activities and evaluate control effectiveness.
• Assist with the development of audit procedures, compliance documentation, metrics, and management reports.
• Participate in continuous improvement initiatives related to IT governance, cybersecurity risk, compliance, and internal controls.

Requirements

Candidates should have experience in several of the following areas:

• IT auditing and technology control assessments
• Cybersecurity governance, risk, and compliance
• Information security controls
• Audit findings and remediation tracking
• Regulatory or compliance assessments
• Audit evidence collection and documentation
• Risk-based assessments
• Compliance reporting and executive dashboards
• IT infrastructure, applications, cloud technologies, and security controls
• Communicating audit and security findings to both technical and non-technical stakeholders

Skills

Framework Experience

Strong experience with one or more of the following is highly desirable:

• NIST Cybersecurity Framework (NIST CSF)
• NIST SP 800-53
• ISO/IEC 27001
• Related cybersecurity, risk, and compliance frameworks

Qualifications

Professional certifications are highly valued, including:

• CISA — Certified Information Systems Auditor
• CRISC — Certified in Risk and Information Systems Control
• CISM — Certified Information Security Manager
• Equivalent IT audit, cybersecurity, risk, or compliance certifications

Ideal Candidate

You will be a strong fit if you can independently analyze technical and audit documentation, evaluate security controls, identify compliance gaps, communicate findings clearly, and manage multiple audit or remediation activities simultaneously. Experience supporting IT audits, regulatory examinations, cybersecurity compliance assessments, or enterprise GRC programs will be particularly valuable.

This is a hybrid position based in Harrisburg, Pennsylvania, requiring onsite presence 3 days per week. Candidates should be local to Harrisburg or the surrounding area, or able to reliably meet the onsite requirement.