-Information Systems Auditor- CISA

Silverthorne Advisory Group • Scott AFB, IL

3d • Onsite

About The Position

Silverthorne Advisory Group is seeking an Information Systems Auditor to support federal and Defense-sector missions. The position evaluates information technology controls, cybersecurity safeguards, governance processes, and enterprise risk management programs while supporting federal financial management, audit readiness, and digital modernization initiatives. The auditor performs risk-based IT audits and assesses IT General Controls (ITGCs), application controls, and cybersecurity controls, then develops recommendations to strengthen security, compliance, and operational efficiency. The role works closely with cybersecurity professionals, IT teams, finance organizations, business stakeholders, and external auditors to identify technology risks and improve internal controls. It also offers the opportunity to apply information systems auditing, cybersecurity, data analytics, and emerging artificial intelligence capabilities to federal and Defense missions. The position is on-site at Scott Air Force Base, Illinois, and requires U.S. citizenship and an active Secret security clearance; sponsorship may be available for qualified candidates. CISA certification is preferred.

Requirements

• At least 3 years of experience in IT auditing, information security, cybersecurity, technology risk management, internal audit, or technology consulting.
• Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, Accounting, Information Technology, or a related field.
• U.S. citizenship and an active Secret security clearance; clearance sponsorship may be available for qualified candidates.
• Experience performing IT General Controls (ITGC) testing and technology risk assessments.
• Knowledge of control frameworks and standards including the NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-171, COBIT, COSO, and FISCAM.
• Experience evaluating logical access, identity and access management, change management, configuration management, and backup and recovery controls.
• Understanding of cybersecurity principles, internal controls, compliance requirements, and enterprise risk management.
• Experience documenting audit procedures, preparing findings, and developing actionable recommendations.
• Strong analytical, problem-solving, organizational, written communication, and verbal communication skills.
• Ability to manage multiple priorities, work independently, and collaborate effectively in a fast-paced consulting environment.

Nice To Haves

• Certified Information Systems Auditor (CISA) certification.
• Experience supporting Department of War (DoW), federal civilian, or Intelligence Community clients.
• Familiarity with FISMA, FedRAMP, the Risk Management Framework (RMF), CMMC 2.0, GAO Green Book, and OMB Circular A-123.
• Experience assessing cloud environments such as Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).
• Familiarity with Microsoft Defender, Microsoft Sentinel, Microsoft Entra ID, Microsoft Intune, ServiceNow, SAP, Oracle, or Workday.
• Experience with data analytics, SQL, Power BI, Python, PowerShell, or audit automation tools.
• Additional certifications such as CISSP, CISM, CRISC, CIA, CPA, CGFM, Security+, or PMP.
• Experience supporting SOC 1, SOC 2, ISO 27001, PCI DSS, HIPAA, or SOX compliance initiatives.
• Experience leading audit engagements, mentoring junior team members, or presenting findings to senior leadership.
• Strong consulting, stakeholder management, and client relationship skills.

Responsibilities

• Plan, execute, and document risk-based information systems audits and technology risk assessments.
• Evaluate IT General Controls (ITGCs), application controls, automated business processes, and financial system controls.
• Assess cybersecurity safeguards, identity and access management, data protection, and privileged access controls.
• Identify control deficiencies, security vulnerabilities, compliance gaps, and risk mitigation opportunities.
• Prepare audit workpapers, document findings, develop recommendations, and communicate results to stakeholders.
• Track corrective actions and validate remediation efforts.
• Support compliance with federal regulations, cybersecurity standards, and audit frameworks, including NIST, FISMA, COBIT, FISCAM, and FedRAMP.
• Review change management, configuration management, backup and recovery, disaster recovery, and business continuity controls.
• Evaluate security controls across cloud environments, enterprise applications, databases, and IT infrastructure.
• Assess logging and monitoring, incident response, vulnerability management, and security operations practices.
• Support internal and external audits, compliance assessments, and regulatory examinations.
• Collaborate with IT, cybersecurity, finance, and business teams to strengthen governance, internal controls, and audit readiness.
• Identify opportunities to use data analytics, automation, and artificial intelligence to improve audit testing and operational efficiency.
• Stay informed about evolving cybersecurity threats, regulatory requirements, and industry best practices.

Benefits

• Medical, dental, and vision insurance for employees and eligible family members.
• 401(k) plan with a 100% company match on employee contributions up to the first 6%, with access to Vanguard Admiral funds.
• Paid time off based on length of service.
• Performance bonuses based on individual performance and company goals.
• Support for training, continuing education, and professional certifications.
• Team-building activities, company retreats, and professional conferences.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level