IT Security Risk Auditor

Position Summary

MUST BE ABLE TO WORK 2-3 Days onsite in Massachusetts. DO NOT APPLY unless you meet this qualification.

IT Security Risk Auditor

3 year contract

Pay Range: $55-$72/hr

Hybrid: predominantly onsite to start eventually leading to 2-3 days/week on site

Clearance: eligible to obtain Top Secret (interim sufficient to start)

The Security Services Department’s (SSD) overall mission is to enable research and development while keeping the community safe and secure through the protection of information, network, facilities and personnel.

The IT Security Risk Auditor position performs audits of classified and unclassified Information Systems (IS) to ensure they are maintained in a compliant manner and follow applicable laws and government regulations, including NISPOM guidelines, NIST standards, CMMC, DCSA Assessment and Authorization Process Manual (DAAPM), and Laboratory Information System Security Procedures. The candidate must be knowledgeable in fundamental computer security principles and policies such as STIGs, NIST 800-53/Risk Management Framework (RMF), CNSSI 1253, DOD Manual 5205.07 Volumes 1-4, NIST SP 800-171, and DAAPM 2.0.

Responsibilities include maintaining and auditing programs to validate compliance with government regulations and Information Security policies, conducting comprehensive assessments of management, operation, monitoring and technical security controls within Information Systems, determining the overall effectiveness of controls, and conducting open source and internal research to identify threat indicators, exploits, and vulnerabilities.

• Bachelor’s degree in Computer Science, Information Technology, Computer Information Systems, or related field with a minimum of seven (7) years of experience conducting risk assessments.
• Experience in compliance auditing, security reviews, or vulnerability assessments.
• Technical experience and skills, coursework completed toward a degree, and industry IT certifications (i.e. CISSP, CISA) may be considered substitutes for education and experience.
• In-depth knowledge of information security principles and policies such as RMF, NIST SP 800-171, and STIGs.
• Ability to read, understand and apply government regulation, policies and procedures such as NISPOM, 32 CFR Part 117, FAR/DFARS Safeguarding CUI series , etc.), computer security principles and policies, including STIGs and NIST 800-53/Risk Management Framework (RMF) and NIST SP 800-171.
• Working experience directly related to Assessment and Authorization using at least one of the following:
• NIST 800-53/Risk Management Framework (RMF)
• Joint Special Access Program (SAP) Implementation Guide
• NIST SP 800-171 Understanding of CMMC Framework
• National Industrial Security Program Operating Manual (NISPOM) Chapter 8

• Information Assurance Certifications preferred (CISSP/CISA, Security+, CCP/CCA, or other industry-recognized Certification that validate knowledge in Cybersecurity framework or equivalent).
• Direct experience with DCSA facility compliance reviews and security audits.

This position will be predominantly onsite for the first 3-4 months (probably 4 days/wk onsite). After the initial ramp up period, there may be an opportunity for more remote, 2-3 days/week. Long term, candidate must be comfortable with being onsite at least 2+ days and as needed for the project work.

Interim clearance sufficient for start; but candidate will need to clear up to the Top Secret Level.