Audit Specialist - Cyber Security (Mid-Level)

ASSYST, Inc.•Baltimore, MD

About The Position

ASSYST's Information Assurance and Cyber Security Practice is seeking a mid-level (Audit Specialist - Cyber Security) to support our Federal Program. ASSYST is currently managing Cyber initiatives for various customers including Federal, State, and Local governments. Our end-to-end services cover architecture, design, policy, monitoring, detection, remediation, compliance, awareness, and training.

Requirements

3-5 experience in a similar position focused on IT Audit/ Cyber Security supporting Federal programs
Experience in information security, policy and risk management, auditing, and audit management
Familiarity with the Risk Management Framework, NIST 800-53, Vulnerability Analysis, FISMA and FedRAMP.
Strong analytical and problem-solving skills.
Excellent communication and collaboration abilities

Nice To Haves

CISA Certification (Certified Information Systems Auditor)

Responsibilities

Work liaison between external auditors and internal security systems.
Conduct compliance checks and vulnerability assessments for internal teams assuring adherence to FISMA / NIST Framework.
Identify, define, and assess documents for complex system reports and technical requirements within cross functional teams.
Develop and assess reports for audit Project metrics, status reports, risk logs, POAM creation and lessons learned per Audit.
Conduct Data Calls and compliance checks for various audits and projects for security systems.
Working alongside system owners, ISSO, and CRA oversight.
Track all deliverables, report regularly on control exceptions and deficiencies per system, ensure that measures raised in assessments are implemented following risk profiles, and address the root causes of risks using NIST guidelines.
Coordinate preliminary investigations to acquire artifacts for all requests associated with various ad-hoc audits across multiple stakeholders (system owners) and organizations.
Audits for FISMA-A123 and CFO just to name a few.
Perform data entry into client's Governance, Risk, and Compliance tools for audits and system reports for the current and future fiscal year.