Senior Cybersecurity Auditor

Why RTI

RTI International is an independent, scientific research institute dedicated to improving the human condition. Our vision is to address the world's most critical problems with technical and science‑based solutions in pursuit of a better future. Clients rely on us to answer questions that demand an objective and multidisciplinary approach—one that integrates expertise across social, statistical, data, and laboratory sciences, engineering, and other technical disciplines to solve the world’s most challenging problems.

We believe in the promise of science and technical solutions, and we push ourselves every day to deliver on that promise for the good of people, communities, and businesses in the US and around the world. If you are looking for the opportunity to make a real difference, RTI is the place for you.

The person in this role will be part of the Office of the Chief Information Officer (OCISO) Compliance team. This role is responsible for planning and performing audits of information systems and related processes in a multi‑platform environment, including coordination, scheduling, and delivery of all compliance work products. The candidate must be able to interact directly with internal and external clients, manage resources, meet deadlines, assist management in the identification and assessment of technology related risks, report on the adequacy of risk‑based controls, evaluate technology and business‑related controls for integrated IT and business auditing efforts, and provide regular status and service‑level reports to management.

The candidate should have experience managing delivery of work products while working with Federal Government clients and have extensive experience with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF, i.e. NIST 800‑37 and 800‑53).

Essential Duties:

• Author project security authorization packages that must comply with FISMA and the NIST Risk Management Framework.
• Create, collect information, and maintain a security assessment Evidence Library.
• Formulate recommendations to resolve problems impacting the quality and effectiveness of security controls.
• Participate in information security working groups.
• Propose changes to existing policies and procedures to ensure operating efficiency and regulatory compliance.
• Assist resource owners and IT staff in understanding and responding to security audit failures reported by auditors.
• Manage delivery issues and participate in problem and change management meetings.
• Work with various stakeholders and identify information asset owners to classify data and systems as part of a control framework implementation.
• Serve as an active and consistent participant in the information security governance process.
• Work with the CISO and Cybersecurity Compliance Manager and business stakeholders to define metrics and reporting strategies that effectively communicate successes and progress of the security program.
• Manage outsourced vendors that provide information security assessment and auditing functions for compliance with contracted service‑level agreements.
• Participate in new system development and implementation reviews by reviewing project documentation, conducting interviews, and assessing work completed.
• Ensure that development efforts are in compliance with organizational policies, standards and procedures, and controls are adequately incorporated into the systems.
• Work with outside auditors to help reconcile discrepancies or support the external auditing functions and local, federal examinations. May be responsible for developing and implementing tools to support automated audit effort. May perform due diligence and special review(s) work as required by management.
• Plan and perform compliance and internal control audits within each division of RTI.
• Review policies, standards and procedures and provide advice on their adequacy, accuracy and compliance with existing guidelines and regulatory requirements (e.g. FISMA, HIPAA, etc.) and assist in the preparation of ITS Security and Compliance policies.
• Support ITS Security in preparing proposal documents and…