Senior Information Security Auditor

Saliense•McLean, VA

28d

About The Position

The Senior Information Security Auditor serves as a senior advisor and independent assurance professional, evaluating the maturity, effectiveness, and sustainability of federal information security and cybersecurity risk management programs. The role supports readiness for annual FISMA evaluations and independently assesses Information Security Continuous Monitoring (ISCM), security assessment and authorization processes, POA&M management, and cybersecurity governance. The auditor analyzes program performance, identifies systemic and recurring weaknesses, evaluates risk management processes, and provides executive leadership with actionable recommendations to improve cybersecurity program maturity, compliance, and operational effectiveness. The position contributes to FISMA audit readiness, remediation tracking, and continuous process improvement. Qualified candidates should demonstrate direct experience supporting FISMA evaluations, assessing cybersecurity program effectiveness, evaluating POA&M remediation, and developing executive-level risk reporting through specific examples, deliverables, metrics, and measurable outcomes.

Requirements

Bachelor's degree in Cybersecurity, Information Systems, Information Technology, Computer Science, Accounting, Business Administration, Risk Management, or a related discipline.
Active Certified Information Systems Auditor (CISA) certification.
At least 10 years of experience in information systems auditing, federal cybersecurity, IT risk management, FISMA compliance, assessment and authorization, or related disciplines.
Experience supporting or leading federal cybersecurity audits, FISMA evaluations, Inspector General reviews, or independent cybersecurity assessments.
Demonstrated experience assessing cybersecurity program maturity, effectiveness, compliance, and risk management outcomes across multiple systems or organizational components.
Experience developing executive-level reports, dashboards, and briefings for senior federal leadership.
Ability to satisfy applicable federal contract suitability, background investigation, citizenship, and/or security clearance requirements.
Ability to demonstrate direct experience supporting FISMA evaluations, assessing cybersecurity program effectiveness, evaluating POA&M remediation activities, and developing executive-level risk reporting with examples of deliverables, metrics, and measurable outcomes.

Nice To Haves

CISSP, CGRC, CISM, CRISC, CIA, or related certifications.

Responsibilities

Support preparation for annual FISMA audits and evaluations through audit readiness reviews, evidence validation, documentation assessments, and gap identification.
Coordinate responses to FISMA audit requests and facilitate interactions among system owners, ISSOs, ISSMs, cybersecurity teams, program managers, and external auditors.
Analyze recurring audit findings across multiple FISMA evaluation cycles and identify systemic deficiencies contributing to repeat observations.
Assess efforts to address FISMA findings and recommendations, including corrective action plans, remediation milestones, closure packages, and validation activities.
Develop executive-level reports, dashboards, and briefings on FISMA readiness, audit results, remediation status, aging findings, and program risk.
Evaluate the maturity and effectiveness of ISCM programs, including monitoring strategies, performance measures, risk reporting, vulnerability management integration, and management oversight.
Analyze POA&M, assessment, and vulnerability management data to identify recurring findings, aging weaknesses, remediation trends, and enterprise risk patterns.
Evaluate cybersecurity metrics, key performance indicators, dashboards, and management reporting processes for accuracy, usefulness, and alignment with organizational objectives.
Perform portfolio-level analyses to identify enterprise-wide trends, systemic risks, common control weaknesses, and continuous improvement opportunities.
Brief senior executives on recurring findings, aging POA&Ms, emerging risks, remediation impediments, and strategic program improvements.
Provide technical leadership, mentoring, and quality reviews of audit methodologies, analyses, findings, reports, and other deliverables.