SOC/CSSP Auditor

TekSynap•Fort Belvoir, VA

2d•$120,000 - $170,000•Onsite

About The Position

The SOC/CSSP Auditor provides independent oversight, compliance validation, and operational quality assurance across the Cybersecurity Service Provider (CSSP) environment. The role establishes a continuous audit and inspection-ready posture by validating cybersecurity operations, telemetry quality, evidence traceability, regulatory compliance, and operational performance metrics. It works across Protect, Detect, Respond, and Sustain functions to ensure operations align with DoD requirements, NIST guidance, CSSP Evaluator Scoring Metrics (ESM), and organizational quality standards. The position supports TekSynap’s prime contract with the Defense Threat Reduction Agency. It is based in an office environment at Fort Belvoir, Virginia, with a Monday–Friday schedule of 0800–1600. Evening and weekend work may be requested to meet program and contract needs, and travel is less than 10%. U.S. citizenship and an active Top Secret clearance with SCI eligibility are required. The work includes governing and auditing telemetry quality; ensuring evidence and defensive actions are fully traceable; managing SOPs, playbooks, and the SharePoint Master SOP Library; mapping CSSP controls and evidence to NIST requirements; preparing for government assessments and inspections; conducting independent quality assurance; and driving corrective actions and continuous improvement. The role requires a bachelor’s degree, a required CISA certification, a DoD 8140/8570 CSSP Auditor certification or equivalent, and substantial cybersecurity audit, monitoring, or compliance experience.

Requirements

Active Top Secret clearance with SCI eligibility.
U.S. citizenship.
DoD 8140/8570 CSSP Auditor certification or equivalent.
Certified Information Systems Auditor (CISA) certification.
Bachelor’s degree (BA/BS).
At least 7 years of progressive experience in cybersecurity auditing, continuous monitoring, or compliance assessment, or at least 5 years with a master’s degree.
At least 3 years supporting DoD or federal cybersecurity programs.
Experience supporting audit, inspection, or accreditation activities in a SOC, CSSP, Cyber Defense Program, or related environment.
Proven experience auditing database/SIEM logs, data-ingestion schemas, and validating compliance data flows.
Work schedule is Monday–Friday, 0800–1600; may be requested to work evenings and weekends to meet program and contract needs.
Ability to meet the physical demands described, including handling, reaching, talking, hearing, standing, walking, sitting, climbing or balancing, stooping, kneeling, crouching, crawling, and lifting up to 50 pounds.

Nice To Haves

Familiarity with data dictionaries, data validation rules, and automated log analysis.
Experience or knowledge in three or more of the following areas: DoD CSSP operations; Risk Management Framework (RMF); NIST SP 800-53 Rev. 5 and NIST SP 800-53A; DoDI 8530.01 and applicable CSSP guidance; CNSSI 1253; Security Technical Implementation Guides (STIGs); continuous monitoring programs; incident response processes; vulnerability management programs; audit, compliance, and inspection readiness activities; MITRE ATT&CK Framework.

Responsibilities

Establish, govern, and audit the CSSP Data Quality Scoring (DQS) framework, including telemetry metrics such as Parsing Success Rate, Field Completeness Score, Schema Adherence Score, and Timeliness Score.
Track and analyze low-DQS data sources and data-loss visibility gaps, and manage remediation.
Validate data collection, normalization, enrichment, and correlation processes to ensure critical security events are accurately represented throughout the detection lifecycle.
Manage and validate CSSP Evidence Objects, ensuring defensive cyber actions are documented and evidence packages meet internal policies and external assessment requirements.
Verify traceability from source telemetry through analyst actions and incident response activities to cybersecurity risk-reduction decisions.
Lead the lifecycle of SOPs, playbooks, and operational workflows; develop and track an annual review plan for CSSP documentation.
Manage the SharePoint Master SOP Library, including version control, access permissions, and formal archival processes, and verify that published SOPs align with current DED requirements and operational capabilities.
Map CSSP operational controls and evidence logs to NIST SP 800-53 Rev. 5 control families and embed NIST SP 800-53A Examine, Interview, and Test methods into internal audit procedures.
Lead preparation for and support of CSSP ESM assessments, CORA, JFHQ-DODIN evaluations, and other government-directed inspections.
Coordinate evidence collection, validation, scoring reviews, and corrective-action tracking to maintain a continuous inspection-ready posture.
Define, monitor, and report internal performance metrics in alignment with DTM 26-003.
Conduct recurring independent audits across Protect, Detect, Respond, and Sustain teams, assessing procedural compliance, documentation quality, operational consistency, analyst performance evidence, and service delivery requirements.
Identify recurring compliance deficiencies, operational trends, systemic weaknesses, and process inefficiencies; develop lessons-learned reports and corrective-action recommendations.
Facilitate continuous improvement initiatives that strengthen cybersecurity effectiveness, audit readiness, and mission performance.