Cybersecurity Quality Assurance Analyst Independent Verification and Validation (IV&V)
RemoteUnited States
Job Summary
Review cybersecurity assessment documentation for accuracy, completeness, and compliance with federal frameworks. Conduct independent verification and validation of technical findings and risk statements against ISO, SOC, and NIST standards. Evaluate evidence, identify deficiencies, and provide feedback to assessment teams to maintain quality consistency. Maintain documentation, audit trails, and quality records while supporting internal audit activities and process improvement initiatives. Prepare reports for management review and recommend enhancements to assessment processes. This role ensures high-quality, defensible assessment outputs that meet customer and regulatory requirements.
Required Qualifications
- Senior level positions require seven or more years of relevant cybersecurity experience
- At least five years of experience in Information Security Governance, Risk, and Compliance
- At least three years of experience in third party cybersecurity risk management
- Candidate must hold and provide proof of at least one of the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Third Party Risk Professional (CTPRP), Certified Third Party Risk Assessor (CTPRA)
- Experience assessing and mitigating risks associated with vendor relationships and vendor control evaluations
- Experience performing risk-based due diligence
- Technical understanding of cybersecurity concepts and working knowledge of ISO 27001, SOC 1 and SOC 2, NIST SP 800-53, and NIST SP 800-171
- Experience evaluating third party cyber risk
- Experience conducting assessments using NIST SP 800-53 within a federal agency
- Experience in cybersecurity control assessment environments
- Understanding of the Systems Development Life Cycle and its application to secure systems
Desired Qualifications
- Advanced degree in a cybersecurity or technical field preferred, with experience or directly relevant certifications substituting for academic credentials
- Advanced degree preferred
- Experience and certifications may be substituted for formal education on a case by case basis
- Expertise in writing technical and risk management reports
- Strong analytical, problem solving, and organizational skills
- Experience developing and implementing sustainable third party cyber risk processes
- Strong verbal and written communication skills
- Effective technical writing and documentation capabilities
- Ability to document cyber assessments and communicate results clearly
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.