Cybersecurity Senior Associate; Offensive Security

Ranked among the largest accounting and consulting firms in the country and consistently recognized as a Great Place to Work, Cherry Bekaert delivers innovative advisory, assurance and tax services to our clients. At Cherry Bekaert we create shared success through teamwork, energy, and expertise. We approach today’s toughest business challenges with a client-first mindset, working together to create exceptional value. We are all committed to making a difference for our people, our clients, our community, and our professions.

To meet this commitment, Cherry Bekaert will provide you with the space to pursue growth and development opportunities that will guide and support you at each stage of your personal and professional journey.

In support of our growing Information Assurance & Cybersecurity Solutions practice, we have an excellent opportunity for a Senior Associate to join our team in the West Warwick, RI office with hybrid flexibility provided. Our ideal candidate will have demonstrated experience performing an array of technical offensive security related tasks such as red teaming, pen testing, and vulnerability, configuration & server infrastructure assessments and the capability to support security compliance engagements for frameworks including:

• CMMC, NIST Cybersecurity Framework, NIST 800-115, NIST 800-171, NIST 800-53 (FISMA, FedRAMP, etc.)
• ISO 27001/27002, PCI, HIPAA/HITRUST, FFIEC
• AICPA Cybersecurity Risk Management Framework
• AICPA SOC 1/2/3

As a Senior Associate, you will:

Maintain a strong client focus by understanding the client’s business needs while developing productive working relationships with client personnel in order to accomplish objectives across a variety of engagements related to:

Offensive Security (66%)

• Assist in the planning, scoping, and execution of internal and external penetration tests across networks, applications, cloud environments, APIs, and mobile platforms
• Perform vulnerability assessments using industry-standard tools (e.g., Nessus, Nmap, Burp Suite, Metasploit) and validate findings through manual techniques and exploitation
• Conduct open-source intelligence (OSINT) gathering to support red team operations, social engineering engagements, and external threat profiling
• Identify and exploit security weaknesses in network protocols, operating systems, web applications, and enterprise technologies
• Prepare detailed technical reports and executive-level summaries of penetration testing results, risk ratings, and remediation recommendations
• Maintain awareness of the latest vulnerabilities, attack techniques, threat actor tactics, and industry developments; assist in developing internal penetration testing methodologies, standard operating procedures, and security testing templates
• Conduct cyber risk and gap assessments aligned to industry frameworks such as NIST Cybersecurity Framework (CSF), NIST 800-53, HIPAA Security Rule, ISO 27001, and CIS Controls
• Mentor junior team members and assist in the knowledge transfer of offensive security skills and tools

Security Compliance (33%)

• Support and conduct CMMC Level 1–3 assessments, SOC 1 and SOC 2 engagements, including control validation, evidence collection, and gap analysis
• Perform walkthroughs and interviews with key stakeholders to assess cybersecurity and compliance control design and effectiveness
• Review and evaluate evidence for CMMC, SOC 1, and SOC 2 engagements to determine control implementation and maturity
• Document testing procedures, assessment findings, and conclusions in a clear, organized, and audit-ready manner
• Draft formal deliverables such as CMMC readiness reports, SOC 1/SOC 2 control narratives

What you bring to this role:

• Bachelor’s Degree, preferably in Information Security, Information Systems, Computer Science, Accounting or Mathematics

• Minimum 2+ years of relevant offensive security/security compliance experience, preferably in a client-facing capacity within a consulting firm
• Understanding of technology risk management and IT governance principles and familiarity with cybersecurity solution offerings used to meet business and technical objectives
• Working knowledge of Microsoft, Linux & OSX operating systems
• Pract…