Ardent - Cyber Lead Auditor / Test Lead
Requirements
• Bachelor’s degree in cybersecurity, information assurance, audit, information systems, or related discipline. • Proof of relevant professional certifications such as CISSP, CISA, PMP, CEH, or other relevant certifications. • 10 years of progressive cybersecurity experience, including security operations, incident response, vulnerability management, intrusion analysis, adversary simulation, technical assessment, or audit support. • 5 years supporting or conducting audits, compliance reviews, independent assessments, or assurance work in government or similarly regulated environments. • Demonstrated ability to design defensible test procedures, evaluate control performance, distinguish fact from opinion, and communicate technical results to senior stakeholders. • Working knowledge of professional auditing or assurance standards and evidence requirements. • Purple-team or adversary-emulation leadership using MITRE ATT&CK and threat-informed kill chains. • Government incident-command experience. • CISA, CIA, or other audit credential. • Experience with Active Directory, cloud platforms, APIs, web applications, databases, endpoints, SIEM/EDR, vulnerability scanners, and evidence repositories. • Due to the nature of the work we support, all candidates in consideration for this role must be willing to undergo the government issued background investigation process.
Responsibilities
• Lead ingestion and analysis of agency documentation, including risk assessments, remediation plans, prior findings, corrective actions, inventories, and strategic plans. • Direct development of the Agency Risk Understanding Memorandum, including environmental summaries, agency-specific risks, assumptions, documentation gaps, and impacts on testing priorities. • Design the Ground-Truth and Ad Hoc Testing Strategies and approve detailed procedures defining objectives, systems, controls, access points, tools, sampling, scripts, evidence, thresholds, stop conditions, and escalation paths. • Map procedures and results to NIST CSF DE.AE, DE.DP, PR.AC; Rule 60GG-2, F.A.C.; and the applicable approved criteria. • Ensure testing remains within written OCIG authorization, avoids duplication of operational testing, and complies with agency-specific Rules of Engagement. • Review evidence for relevance, reliability, sufficiency, attribution, timestamps, chain of custody, and reproducibility. • Validate that reports accurately state procedures performed and factual results without an audit opinion; ensure advisory recommendations are distinctly labeled. • Conduct independent QA reviews of technical deliverables not authored solely by the reviewer and document sign-off. • Lead technical briefings, workshops, job aids, and knowledge transfer so OCIG and OIG staff can understand and reuse procedures. • Support urgent analysis of logs, timelines, after-action reports, remediation evidence, and incident-specific control issues when directed.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT