Senior Information Security Internal Auditor

Everbridge

1d•$118,700 - $158,200•Remote

About The Position

Everbridge is seeking a Senior Information Security Internal Auditor to develop and maintain its information security internal audit program within the Compliance portfolio. The role aligns the program with FedRAMP, CMMC, and other applicable requirements, and maintains the Information Security and Privacy Framework, including policies, procedures, standards, and guidelines. This is a fully remote, home-based position open to candidates anywhere in the United States. The auditor translates framework requirements into technical controls and acceptance criteria, partners with Engineering, DevOps, and Security to integrate controls into workflows, and owns monthly continuous monitoring assessments and submissions. The role coordinates CMMC and FedRAMP documentation and project milestones, serves as a technical point of contact during audits, and represents Compliance in certification projects and strategy discussions. The position also builds automated evidence collection across cloud platforms, identity providers, CI/CD pipelines, and ticketing systems; develops policy-as-code and continuous control monitoring checks; and owns and improves the GRC platform and its integrations. Responsibilities include creating audit plans and reports, maintaining documentation and evidence, establishing processes and guidelines, developing continuous monitoring and recertification approaches, supporting external audits, and assisting with other audit activities.

Requirements

At least three years of experience in security, assessments, compliance consulting, or advisory work in a highly technical environment.
At least three years of experience performing or supporting technical assessments for a major compliance effort, such as CMMC, FedRAMP, SOC 2, BSI C5, or ISO 27001.
Experience with CMMC, DFARS, NIST SP 800-171, FedRAMP, NIST SP 800-53, FISMA, or similar governance and compliance frameworks.
Experience in cloud security, platform engineering, or DevSecOps.
Experience with Infrastructure as Code, such as Terraform, and integrating security tools into CI/CD pipelines.
Strong understanding of information collection, reporting, and documentation processes, including developing status reports, metrics, and measures.
Ability to explain technical risk to non-technical stakeholders and translate audit requirements for engineers, verbally and in writing.
Clear communication, strong organization and interpersonal skills, and the ability to take initiative and influence decision-makers.
Must be a U.S. citizen and able to obtain a Secret clearance.

Nice To Haves

A CISSP, CIA, CISA, CySA+, CCSP, or ISO 27001 Auditor certification.

Responsibilities

Develop and maintain the information security internal audit program within the Compliance portfolio, aligning it with FedRAMP, CMMC, and other applicable requirements.
Maintain the Information Security and Privacy Framework, including policies, procedures, standards, and guidelines.
Translate framework requirements into clear, testable technical controls and acceptance criteria for engineering teams.
Partner with Engineering, DevOps, and Security to integrate effective controls into existing workflows.
Own monthly continuous monitoring (ConMon) assessments and submissions.
Coordinate with Engineering and Operations to deliver CMMC and FedRAMP documentation on time and meet project milestones.
Serve as a technical point of contact during audits, explaining architecture, data flows, and control evidence in a cloud environment.
Represent Compliance in FedRAMP, CMMC, and other certification projects and strategy discussions.
Build and maintain automated evidence collection across cloud platforms, identity providers, CI/CD pipelines, and ticketing systems.
Develop policy-as-code and continuous control monitoring checks using tools such as OPA, Cloud Custodian, or AWS Config.
Own and improve the GRC platform and its integrations.
Create audit plans and reports, maintain organized documentation and evidence, and establish clear processes and guidelines.
Develop approaches for continuous monitoring and recertification, support external audits, and assist with other audit activities as needed.