Note: The job is a remote job and is open to candidates in USA. SMX Services & Consulting, Inc. is seeking a Cybersecurity Audit Project Manager / Lead SME to support the State of Florida Executive Office of the Governor, Office of the Chief Inspector General. The role provides project leadership and cybersecurity audit subject matter expertise for developing and implementing a standardized cybersecurity audit program, training, risk-based audit planning, audit tools, governance, and reporting.
Responsibilities
- Lead project kickoff, planning, scheduling, communications, risk management, action-item tracking, and deliverable coordination
- Coordinate development and maintenance of the Master Project Plan and associated project-management documentation
- Lead development of a standardized cybersecurity audit program aligned with Florida Cybersecurity Standards, NIST Cybersecurity Framework, and other standards applicable to the engagement
- Develop and review cybersecurity audit procedures covering risk assessment, control testing, evidence collection, documentation sufficiency, and risk-based audit scoping
- Provide cybersecurity and audit subject matter expertise to government auditors throughout the engagement
- Provide technical guidance regarding cybersecurity controls, testing approaches, audit scope, evidence sufficiency, control evaluation, findings, risks, and remediation considerations
- Review and refine cybersecurity audit workpapers, testing procedures, and supporting documentation
- Lead or oversee cybersecurity audit training for beginner, intermediate, and advanced audiences
- Support development of instructor-led training, prerecorded modules, micro-learning sessions, hands-on exercises, case studies, facilitator guides, and audit walkthroughs
- Facilitate cybersecurity audit-planning sessions and assist with annual and multi-year cybersecurity audit planning
- Support development of a strategic cybersecurity audit roadmap and prioritized cybersecurity risk inventory
- Map applicable cybersecurity risks and audit activities to NIST Cybersecurity Framework domains and other applicable criteria
- Manage ongoing cybersecurity SME-support activities and ensure requests are addressed within the response periods established by the RFQ
- Conduct quality-control reviews of deliverables before submission to the State
- Audit Steps Template
- Risk and Control Matrix
- Self-Assessment Tools
- Evidence Checklist
- Testing Guide
- Sampling Worksheet
- Reporting Template
- Coordinate project governance activities
- Support preparation of required monthly progress reports
- Track milestones, dependencies, project risks, and corrective actions
- Maintain or oversee required training and SME-support records
- Coordinate maintenance of the project's centralized secure information repository
- Oversee training evaluations and learning-outcome assessments
- Support annual cybersecurity audit needs-assessment activities
- Prepare or review associated technical and management reports
Skills
- Candidates must possess experience appropriate to the cybersecurity audit and compliance responsibilities of the engagement
- At least five years of experience supporting or conducting audits or compliance reviews in a government environment
- Cybersecurity and information security
- IT and cybersecurity auditing
- Government compliance reviews
- Cybersecurity risk management
- Security-control assessment and testing
- NIST cybersecurity frameworks
- Risk-based audit planning
- Audit evidence evaluation
- Development of audit procedures and workpapers
- Cybersecurity governance
- Findings and remediation analysis
- Project and deliverable management
- Technical and executive reporting
- Training and knowledge transfer
- Relevant certifications include:
- CISSP – Certified Information Systems Security Professional
- CISA – Certified Information Systems Auditor
- PMP – Project Management Professional
- CEH – Certified Ethical Hacker
- Other directly relevant cybersecurity, audit, risk, or project-management certifications
- Personnel must be U.S.-based
- Offshore performance is not permitted
- The strongest candidate will combine:
- Strong knowledge of cybersecurity controls, risk assessment, NIST frameworks, security-control testing, and remediation
- Demonstrated experience supporting or conducting government cybersecurity, IT, or compliance audits
- Ability to manage government stakeholders, multiple deliverables, schedules, cybersecurity SMEs, training activities, quality assurance, and reporting
- The successful candidate must be capable of translating complex cybersecurity requirements into practical and repeatable audit procedures, testing methodologies, tools, and training materials for government auditors
- A bachelor's degree in cybersecurity, information systems, computer science, information technology, accounting/auditing, business, or a related discipline is preferred
Benefits
- United States / Remote
Company Overview