The work

The Audit & Cybersecurity Manager is responsible for leading complex risk assessments, security governance, and compliance monitoring

Key responsibilities:

• Lead efforts to enable security-compliant S/4HANA solutions, ensuring that functional and technical designs incorporate "Security by Design" and "Least Privilege" principles
• Oversee the development of SAP Security Roles, ensuring Segregation of Duties (SoD) is maintained and that sensitive federal data is protected via robust authorization concepts
• Assess and manage risk-reducing behaviors and processes, implementing continuous monitoring frameworks to detect and mitigate insider threats and external vulnerabilities
• Drive the implementation of SAP GRC (Access Control / Process Control) or similar tools to automate audit logging and compliance reporting
• Review and integrate security requirements across the Universal Journal, PII-heavy modules (H2R), and high-value financial workstreams (B2R/P2R)
• Provide input into final decisions regarding cybersecurity tools, identity and access management (IAM), encryption standards, and secure integration with external interfaces
• Manage and ensure compliance with federal mandates, such as NIST 800-53, FISMA, and the DATA Act, while preparing the organization for unmodified audit opinions
• Facilitate the audit lifecycle, serving as the central point of contact for audit inquiries, managing the collection of evidence, and driving the remediation of any identified findings
• Execute program management support functions for the security workstream, including staffing specialized cyber resources, budgeting for security software, and forecasting compliance needs
• Monitor and report on security posture, providing executive-level dashboards on risk exposure, SoD violations, and the status of audit-readiness activities
• Mentor and train junior team members, fostering a culture of risk awareness and technical excellence in SAP security configuration and audit techniques

Here’s what you need:

• Proven leadership skills at a Manager level, with a track record of successfully navigating complex federal audits or large-scale cybersecurity transformations
• In-depth knowledge of Cybersecurity Frameworks, including experience with NIST, FISMA, or SOC 1/SOC 2 compliance within an ERP environment
• Strong communication and interpersonal skills to effectively collaborate with Chief Information Security Officers (CISOs), Internal Auditors, and technical architects
• Proficiency in risk management and mitigation, specifically the ability to translate technical vulnerabilities into business-risk impact statements for leadership

Eligibility requirements:

• US Citizen (no dual citizenship)
• Must be eligible to obtain a government Secret Clearance

The work

The Senior Information System Security Officer (ISSO) ensures the security, compliance, and continuous monitoring of enterprise information systems. This role supports federal security frameworks, risk management activities, and audit readiness efforts while safeguarding sensitive organizational data. The ISSO will collaborate with technical teams, leadership, and auditors to assess vulnerabilities, maintain authorization documentation, and strengthen governance and compliance processes across the environment.

Key responsibilities:

• Support risk management and continuous monitoring activities to identify and mitigate security vulnerabilities
• Administer and maintain GRC tools to support audit logging, compliance reporting, and security control monitoring
• Prepare documentation and evidence to support federal audits (NIST 800‑53, FISMA, SOC 1/SOC 2, DATA Act, etc.)
• Maintain and update Security Authorization Package artifacts such as SSPs, Risk Assessments, and Security Control Assessments
• Support remediation activities and track audit inquiries and corrective actions
• Assist with project management functions including milestone tracking, compliance forecasting, and deliverable oversight
• Produce regular security posture reports and executive‑level dashboards
• Ensure enforcement of security policies, procedures, and RMF requirements
• Work cross‑functionally with administrators, developers, and stakeholders to integrate security best practices
• Translate complex technical vulnerabilities into clear, actionable insights for leadership and auditors

Here’s what you need:

• 7–9 years of experience in cybersecurity, compliance, or audit
• Strong knowledge of GRC, RMF, NIST 800‑53, FISMA, SOC 1/SOC 2, and federal cybersecurity guidelines
• Experience supporting security compliance within enterprise or ERP environments
• Proficiency with GRC tools and audit logging platforms
• Strong analytical and problem‑solving skills to assess root causes and recommend mitigations
• Ability to manage multiple tasks in a fast‑paced, audit‑driven environment
• Excellent written and verbal communication skills, with the ability to simplify complex topics for non‑technical audiences
• Demonstrated collaboration skills across functional and technical teams

Nice to have:

• CISSP, CISM, CAP, Security+, or similar certifications
• Experience supporting federal agency audits
• Familiarity with SIEM platforms (e.g., Splunk) or endpoint detection and response tools
• Experience developing and delivering security awareness training

Eligibility requirements:

• Must hold an active TS clearance
• US Citizen (no dual citizenship)