-Information Systems Auditor- CISA

Silverthorne Advisory Group LLC • Scott AFB, IL

3d • Onsite

About The Position

Silverthorne Advisory Group is seeking an Information Systems Auditor to support opportunities in the Defense sector. The role evaluates information technology controls, cybersecurity safeguards, governance processes, and enterprise risk management programs in support of federal financial management, audit readiness, and digital modernization initiatives.

The successful candidate will perform risk-based IT audits, assess IT General Controls (ITGCs), application controls, and cybersecurity controls, and develop recommendations to improve security, compliance, and operational efficiency. The position collaborates with cybersecurity professionals, IT teams, finance organizations, business stakeholders, and external auditors to identify technology risks and strengthen internal controls. It also offers the opportunity to apply data analytics, automation, and emerging artificial intelligence capabilities in support of federal and Defense missions.

The position is full-time and salaried, on-site at Scott Air Force Base, Illinois. An active Secret clearance is required; sponsorship may be available for qualified candidates. CISA certification is preferred.

Requirements

• Minimum of 3 years of experience in IT auditing, information security, cybersecurity, technology risk management, internal audit, or technology consulting.
• Bachelor's degree in Information Systems, Computer Science, Cybersecurity, Accounting, Information Technology, or a related field.
• U.S. citizenship and an active Secret security clearance; sponsorship may be available for qualified candidates.
• Experience performing IT General Controls (ITGC) testing and technology risk assessments.
• Knowledge of control frameworks and standards, including NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-171, COBIT, COSO, and FISCAM.
• Experience evaluating logical access, identity and access management, change management, configuration management, and backup and recovery controls.
• Understanding of cybersecurity principles, internal controls, compliance requirements, and enterprise risk management.
• Experience documenting audit procedures, preparing findings, and developing actionable recommendations.
• Strong analytical, problem-solving, organizational, written communication, and verbal communication skills.
• Ability to manage multiple priorities, work independently, and collaborate effectively in a fast-paced consulting environment.

Nice To Haves

• Certified Information Systems Auditor (CISA) certification.
• Experience supporting Department of War (DoW), federal civilian, or Intelligence Community clients.
• Familiarity with FISMA, FedRAMP, the Risk Management Framework (RMF), CMMC 2.0, GAO Green Book, and OMB Circular A-123.
• Experience assessing cloud environments, including Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).
• Familiarity with enterprise security and business platforms such as Microsoft Defender, Microsoft Sentinel, Microsoft Entra ID, Microsoft Intune, ServiceNow, SAP, Oracle, or Workday.
• Experience with data analytics, SQL, Power BI, Python, PowerShell, or audit automation tools.
• Additional certifications such as CISSP, CISM, CRISC, CIA, CPA, CGFM, Security+, or PMP.
• Experience supporting SOC 1, SOC 2, ISO 27001, PCI DSS, HIPAA, or SOX compliance initiatives.
• Experience leading audit engagements, mentoring junior team members, or presenting findings to senior leadership.
• Strong consulting, stakeholder management, and client relationship skills.

Responsibilities

• Plan, execute, and document risk-based information systems audits and technology risk assessments.
• Evaluate IT General Controls (ITGCs), application controls, automated business processes, and financial system controls.
• Assess cybersecurity safeguards, identity and access management, data protection, and privileged access controls.
• Identify control deficiencies, security vulnerabilities, compliance gaps, and opportunities for risk mitigation.
• Prepare audit workpapers, document findings, develop recommendations, and communicate results to stakeholders.
• Track corrective actions and validate remediation efforts.
• Support compliance with federal regulations, cybersecurity standards, and audit frameworks, including NIST, FISMA, COBIT, FISCAM, and FedRAMP.
• Review change management, configuration management, backup and recovery, disaster recovery, and business continuity controls.
• Evaluate security controls across cloud environments, enterprise applications, databases, and IT infrastructure.
• Assess logging and monitoring, incident response, vulnerability management, and security operations practices.
• Support internal and external audits, compliance assessments, and regulatory examinations.
• Collaborate with IT, cybersecurity, finance, and business teams to strengthen governance, internal controls, and audit readiness.
• Identify opportunities to use data analytics, automation, and artificial intelligence to improve audit testing and operational efficiency.
• Stay informed about evolving cybersecurity threats, regulatory requirements, and industry best practices.

Benefits

• Medical, dental, and vision insurance for employees and eligible family members.
• 401(k) plan with 100% company match on employee contributions up to the first 6%, with access to Vanguard Admiral funds.
• Paid time off based on length of service.
• Performance bonuses based on individual performance and achievement of company goals.
• Support for training, continuing education, and professional certifications.
• Team-building activities, company retreats, and professional conferences.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level