Senior Information Security Internal Auditor

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and uphold the internal audit program for information security within the Compliance portfolio, ensuring alignment with FedRAMP, CMMC, and other relevant standards.

• Maintain Everbridge’s Information Security and Privacy Framework, which encompasses its policies, procedures, standards, and guidelines.

• Convert framework requirements into clear, testable technical controls and acceptance criteria that engineering teams can execute.

• Collaborate with Engineering, DevOps, and Security to incorporate effective controls into current workflows.

• Take ownership of monthly continuous monitoring (ConMon) assessments and submissions.

• Work with Engineering and Operations to ensure timely delivery of CMMC and FedRAMP documentation while meeting project deadlines.

• Act as a technical liaison during audits; articulate architecture, data flows, and control evidence, helping auditors comprehend cloud-environment requirements.

• Represent Compliance in FedRAMP, CMMC, and other certification initiatives and strategic discussions.

• Construct and sustain automated evidence collection across cloud platforms, identity providers, CI/CD pipelines, and ticketing systems.

• Develop policy-as-code and continuous control monitoring checks utilizing tools such as OPA, Cloud Custodian, or AWS Config.

• Oversee and enhance the GRC platform and its integrations.

• Formulate audit plans and reports, maintain organized documentation and evidence, and establish clear processes and guidelines.

• Create strategies for continuous monitoring and recertification, provide support for external audits, and assist with additional audit activities as required.

⛳️ Requirements

• Minimum of three years of experience in security, assessments, compliance consulting, or advisory roles within a highly technical setting.

• At least three years of experience in conducting or supporting technical assessments for significant compliance projects, such as CMMC, FedRAMP, SOC 2, BSI C5, or ISO 27001.

• Familiarity with CMMC, DFARS, NIST SP 800-171, FedRAMP, NIST SP 800-53, FISMA, or similar governance and compliance frameworks.

• Experience in cloud security, platform engineering, or DevSecOps.

• Proficiency with Infrastructure as Code, like Terraform, and integrating security tools into CI/CD pipelines.

• Strong grasp of information collection, reporting, and documentation processes, including creating status reports, metrics, and measures.

• Capability to communicate technical risks to non-technical stakeholders and translate audit requirements for engineers, both verbally and in writing.

• Excellent communication, strong organizational and interpersonal skills, along with the ability to take initiative and influence decision-makers.

• A CISSP, CIA, CISA, CySA+, CCSP, or ISO 27001 Auditor certification is an advantage.

• Must be a U.S. citizen and eligible to obtain a Secret clearance.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Generous paid time off and holiday policies.

• Professional development opportunities and certifications support.

• Flexible work arrangements and a collaborative work environment.