CSSP Auditor

TekSynap•Fort Belvoir, VA

3d•Onsite

About The Position

The CSSP Auditor provides independent oversight, compliance validation, and operational quality assurance across the Cybersecurity Service Provider (CSSP) environment. The position is responsible for establishing a continuous audit and inspection-ready posture by validating cybersecurity operations, telemetry quality, evidence traceability, regulatory compliance, and operational performance metrics. The CSSP Auditor works across the Protect, Detect, Respond, and Sustain functions to ensure cybersecurity operations align with DoD requirements, NIST guidance, CSSP Evaluator Scoring Metrics (ESM), and organizational quality standards.

Requirements

Active Top-Secret Clearance with SCI eligibility required.
DoD 8140/8570 CSSP Auditor or equivalent certifications is required
Certified Information Systems Auditor (CISA) is required
Minimum of 7+ years of progressive experience in cybersecurity auditing, continuous monitoring, or compliance assessment (or 5+ years with a Master's degree), with a minimum of three (3) years supporting DoD or Federal cybersecurity programs.
Experience supporting audit, inspection, or accreditation activities within a Security Operations Center (SOC), Cybersecurity Service Provider (CSSP), Cyber Defense Program, or related environment.
BA/BS College degree required.
Proven experience auditing database/SIEM logs, data ingestion schemas, and validating compliance data flows.
U.S Citizenship Required
Top Secret Clearance with SCI Eligibility.

Nice To Haves

Familiarity with data dictionaries, data validation rules, and automated log analysis is highly preferred.
DoD Cybersecurity Service Provider (CSSP) operations
Risk Management Framework (RMF)
NIST SP 800-53 Rev. 5 and NIST SP 800-53A
DoDI 8530.01 and applicable CSSP guidance
CNSSI 1253
Security Technical Implementation Guides (STIGs)
Continuous Monitoring programs
Incident Response processes
Vulnerability Management programs
Audit, compliance, and inspection readiness activities
MITRE ATT&CK Framework

Responsibilities

Establish, govern, and audit the CSSP Data Quality Scoring (DQS) framework to evaluate the trustworthiness of ingested security telemetry.
Perform continuous audits of telemetry sources against mandatory DQS metrics, including Parsing Success Rate (PSR), Field Completeness Score (FCS), Schema Adherence Score (SAS), and Timeliness Score (TS).
Track, analyze, and manage the remediation of low-DQS sources and data-loss visibility gaps.
Validate data collection, normalization, enrichment, and correlation processes to ensure critical security events are accurately represented throughout the detection lifecycle.
Manage and validate CSSP Evidence Objects to ensure all defensive cyber actions are fully documented and package-proven.
Ensure absolute traceability from ingested telemetry up to cybersecurity risk-reduction decisions.
Verify complete traceability from source telemetry through analyst actions, incident response activities, and cybersecurity risk-reduction decisions.
Conduct routine audits of evidence packages to ensure compliance with internal policies and external assessment requirements.
Lead the full lifecycle of Standard Operating Procedures (SOPs), playbooks, and internal operational workflows.
Develop, implement, and track an annual review plan for all CSSP documentation.
Manage the SharePoint Master SOP Library, maintaining version control, access permissions, and formal archival processes.
Verify that all published SOPs are synchronized with current DED requirements and operational capabilities.
Map CSSP operational controls and evidence logs directly to NIST SP-800-53 Rev. 5 control families, focusing heavily on Audit and Accountability, System and Information Integrity, and Incident Response.
Embed NIST SP-800-53A assessment methods (Examine, Interview, and Test) into internal audit procedures to support continuous authorization and federal compliance mandates, including OMB M-26-14.
Focus heavily on Audit and Accountability (AU), System and Information Integrity (SI), Incident Response (IR), Configuration Management (CM), and Risk Assessment (RA) controls.
Lead activities supporting CSSP Evaluator Scoring Metrics (ESM) assessments, Cyber Operational Readiness Assessments (CORA), JFHQ-DODIN evaluations, and other government-directed inspections.
Coordinate evidence collection, validation, scoring reviews, and corrective action tracking.
Maintain a continuous inspection-ready posture and reduce organizational dependence on pre-audit preparation cycles.
Define, monitor, and report on internal performance metrics, enforcing strict alignment with DTM 26-003.
Conduct recurring audits across Protect, Detect, Respond, and Sustain teams.
Assess procedural compliance, documentation quality, operational consistency, analyst performance evidence, and adherence to service delivery requirements.
Validate execution against approved processes, operational standards, and organizational objectives.
Identify recurring compliance deficiencies, operational trends, systemic weaknesses, and process inefficiencies.
Develop lessons learned reports and corrective action recommendations.
Facilitate continuous process improvement initiatives that strengthen cybersecurity effectiveness, audit readiness, and mission performance.