About the role
Qualified candidates should be able to demonstrate direct experience supporting FISMA evaluations, assessing cybersecurity program effectiveness, evaluating POA&M remediation activities, and developing executive-level risk reporting through specific examples, deliverables, metrics, and measurable outcomes achieved in prior engagements.
The Senior Information Security Auditor serves as a senior advisor and independent assurance professional responsible for evaluating the maturity, effectiveness, and sustainability of federal information security and cybersecurity risk management programs. This role supports organizational readiness for annual FISMA evaluations and provides independent assessments of Information Security Continuous Monitoring (ISCM), security assessment and authorization processes, POA&M management, and cybersecurity governance activities.
The Senior Information Security Auditor analyzes program performance, identifies systemic and recurring weaknesses, evaluates the effectiveness of risk management processes, and provides executive leadership with actionable recommendations to improve cybersecurity program maturity, compliance, and operational effectiveness. This position serves as a key contributor to FISMA audit readiness, remediation tracking, and continuous process improvement efforts.
Active Certified Information Systems Auditor (CISA) certification is required.
What you'll do
- Support organizational preparation for annual FISMA audits and evaluations through audit readiness reviews, evidence validation, documentation assessments, and gap identification.
- Coordinate responses to FISMA audit requests and facilitate interactions among system owners, ISSOs, ISSMs, cybersecurity teams, program managers, and external auditors.
- Analyze recurring audit findings across multiple FISMA evaluation cycles and identify systemic deficiencies contributing to repeat observations.
- Assess organizational efforts to address FISMA findings and recommendations, including corrective action plans, remediation milestones, closure packages, and validation activities.
- Develop executive-level reports, dashboards, and briefings on FISMA readiness, audit results, remediation status, aging findings, and program risk.
- Evaluate the maturity and effectiveness of Information Security Continuous Monitoring (ISCM) programs, including monitoring strategies, performance measures, risk reporting, vulnerability management integration, and management oversight.
- Analyze POA&M, assessment, and vulnerability management data to identify recurring findings, aging weaknesses, remediation trends, and enterprise risk patterns.
- Evaluate cybersecurity metrics, key performance indicators, dashboards, and management reporting processes for accuracy, usefulness, and alignment with organizational objectives.
- Perform portfolio-level analyses to identify enterprise-wide trends, systemic risks, common control weaknesses, and opportunities for continuous improvement.
- Brief senior executives regarding recurring findings, aging POA&Ms, emerging risks, remediation impediments, and strategic program improvements.
- Provide technical leadership, mentoring, and quality reviews of audit methodologies, analyses, findings, reports, and other deliverables.
Qualifications
- Bachelor's degree in Cybersecurity, Information Systems, Information Technology, Computer Science, Accounting, Business Administration, Risk Management, or related discipline.
- Active Certified Information Systems Auditor (CISA) certification required.
- Minimum 10 years of experience in information systems auditing, federal cybersecurity, IT risk management, FISMA compliance, assessment and authorization, or related disciplines.
- Experience supporting or leading federal cybersecurity audits, FISMA evaluations, Inspector General reviews, or independent cybersecurity assessments.
- Demonstrated experience assessing cybersecurity program maturity, effectiveness, compliance, and risk management outcomes across multiple systems or organizational components.
- Experience developing executive-level reports, dashboards, and briefings for senior federal leadership.
- Ability to satisfy applicable federal contract suitability, background investigation, citizenship, and/or security clearance requirements.
- CISSP, CGRC, CISM, CRISC, CIA, or related certifications preferred.