Senior IT Security Auditor
New
A
AptNexusCybersecurity auditing
Candidates must reside in, and perform all work from, the continental United States or its outlying territories., Must be available during core business hours (Eastern Time).Full-TimeSenior
Salary115,000 - 140,000 USD per year
Apply NowOpens the employer's application page
Job Details
- Experience
- Minimum of seven (7) years of cybersecurity experience, including at least five (5) years conducting federal cybersecurity audits or security control assessments.
- Required Skills
- AWSMicrosoft Azure
Requirements
- Have at least seven years of cybersecurity experience, including at least five years conducting federal cybersecurity audits or security control assessments.
- Bring expert working knowledge of NIST SP 800-53 moderate and high baselines, the NIST Risk Management Framework, NIST SP 800-30, and FIPS.
- Have hands-on experience testing security configurations on Windows, Linux, UNIX, and macOS.
- Have experience with virtualization and container platforms, including VMware, Hyper-V, Docker, Kubernetes, and OpenShift.
- Have experience assessing databases and network devices, including firewalls, routers, switches, VPN, wireless, VoIP, and SAN/NAS storage.
- Have experience assessing AWS, Microsoft Azure and Microsoft 365, Google, Salesforce, and other FedRAMP-authorized services across SaaS, IaaS, and PaaS.
- Have working knowledge of encryption technologies and standards, including TLS, VPN, and FIPS 140 validated cryptography.
- Be proficient with Tenable Nessus, SCAP, CIS Benchmarks, and DISA STIGs.
- Have exceptional technical writing skills and the ability to produce clear, well-supported, defensible audit findings.
- Have advanced Microsoft Excel and Word skills; VBA macros experience is preferred.
- Hold at least one of these certifications: CISA, CompTIA CySA+, or GIAC GSNA. CISA is preferred.
- Have a high school diploma; a bachelor’s degree in information technology, cybersecurity, information systems, accounting, or a related field is preferred.
- Complete customer-required security awareness training upon onboarding and annually thereafter.
Responsibilities
- Plan and conduct cybersecurity compliance audits of government partner organizations, establishing scope based on systems, data flows, and technologies.
- Validate system inventories and data flows during pre-audit scoping calls and prepare scoping documentation.
- Develop audit schedules and recommend auditor assignments covering in-scope technologies.
- Test technical controls using automated scanning tools and manual configuration reviews against NIST SP 800-53, CIS Benchmarks, and DISA STIGs.
- Evaluate management controls through interviews and examination of policies, procedures, and system artifacts.
- Present audit scope and data flows at opening conferences and technical findings at closing conferences.
- Provide daily written audit status updates and document test results, preliminary findings, final report sections, and corrective action recommendations.
- Prepare after-action reports and review other auditors’ work for accuracy and consistency.
- Provide technical guidance on complex testing and findings and educate audited organizations on security requirements and remediation approaches.
View Full Description & ApplyYou'll be redirected to the employer's site
