Senior Information Security Internal Auditor
Core
Develop and maintain the information security internal audit program, aligning it with FedRAMP, CMMC, and other applicable requirements while building automated evidence collection and policy-as-code checks.
Role type
Senior Information Security Internal Auditor (GRC)
Builds
Automated evidence collection across cloud platforms, identity providers, CI/CD pipelines, and ticketing systems; policy-as-code and continuous control monitoring checks.
Domain
Cloud security, platform engineering, DevSecOps, and government compliance (FedRAMP, CMMC, DFARS, NIST SP 800-171, FISMA).
Required skills
CMMC, DFARS, NIST SP 800-171, FedRAMP, NIST SP 800-53, FISMA, cloud security, Infrastructure as Code (Terraform), CI/CD integration, automated evidence collection, policy-as-code (OPA, Cloud Custodian, AWS Config), GRC platform management.
Preferred skills
CISSP, CIA, CISA, CySA+, CCSP, ISO 27001 Auditor certification.
Technologies
Terraform, OPA, Cloud Custodian, AWS Config, CI/CD pipelines, cloud platforms, identity providers, ticketing systems.
Responsibilities
Develop and maintain the information security internal audit program within the Compliance portfolio; Maintain Everbridge's Information Security and Privacy Framework; Translate framework requirements into clear, testable technical controls and acceptance criteria; Partner with Engineering, DevOps and Security to integrate effective controls into existing workflows; Own monthly continuous monitoring (ConMon) assessments and submissions; Coordinate with Engineering and Operations to deliver CMMC and FedRAMP documentation on time; Serve as a technical point of contact during audits; Represent Compliance in FedRAMP, CMMC and other certification projects; Build and maintain automated evidence collection across cloud platforms, identity providers, CI/CD pipelines and ticketing systems; Develop policy-as-code and continuous control monitoring checks using tools such as OPA, Cloud Custodian or AWS Config; Own and improve the GRC platform and its integrations; Create audit plans and reports, maintain organized documentation and evidence, and establish clear processes and guidelines.
Seniority
Senior, hands-on IC
