Senior Information Security Internal Auditor

Everbridge; United States; Remote; USD 119,000 - 158,000; Full time

Job summary

Everbridge, a leading provider of critical event management, is seeking a Senior Information Security Internal Auditor for a fully remote role in the United States. You will build and maintain the internal audit program, align it with FedRAMP and CMMC, and work with Engineering, DevOps and Security to implement robust controls across cloud environments.

You will drive continuous monitoring, coordinate certification efforts, and serve as a liaison during audits while enhancing the GRC platform

Qualifications

• At least three years of security, assessments, compliance consulting or advisory work in a highly technical environment.
• At least three years of experience performing or supporting technical assessments for major compliance efforts such as CMMC, FedRAMP, SOC 2, BSI C5 or ISO 27001.
• Experience with CMMC, DFARS, NIST SP 800-171, FedRAMP, NIST SP 800-53, FISMA or similar frameworks.
• Experience in cloud security, platform engineering or DevSecOps.
• Experience with Infrastructure as Code such as Terraform and integrating security tools into CI/CD pipelines.
• Strong ability to document and report processes, metrics and status.
• Ability to explain technical risk to non-technical stakeholders and translate audit requirements for engineers.
• Clear communication and organizational skills with initiative to influence decisions.
• Certification in CISSP/CISA/CCSP/CySA+/ISO 27001 Auditor is a plus, and U.S. citizenship with ability to obtain Secret clearance.

Responsibilities

• Develop and maintain the information security internal audit program within Compliance, aligned with FedRAMP and CMMC.
• Maintain Everbridge’s Information Security and Privacy Framework including policies, procedures and standards.
• Translate framework requirements into testable controls for engineering teams.
• Partner with Engineering, DevOps and Security to integrate controls into workflows.
• Own monthly continuous monitoring assessments and submissions.
• Coordinate with Engineering and Operations to deliver FedRAMP and CMMC documentation on time.
• Serve as technical point of contact during audits and explain architecture, data flows and evidence.
• Represent Compliance in FedRAMP, CMMC and other certification projects.
• Build automated evidence collection across cloud platforms and CI/CD pipelines.
• Develop policy-as-code and continuous control checks using tools like OPA, Cloud Custodian or AWS Config.
• Own and improve the GRC platform and integrations.
• Create audit plans and maintain organized documentation and evidence.
• Develop approaches for continuous monitoring and recertification; support external audits as needed.

Skills

Security assessments

Compliance consulting

Risk communication

Stakeholder influence

Auditing

Policy development

Education

CISSP/CISA/CCSP/CySA+/ISO 27001 Auditor (optional)

Tools

Terraform

CI/CD pipelines

Job description

Everbridge helps enterprises and government organizations prepare for, respond to and recover from critical events. Its critical event management technology helps organizations reduce the impact of disruption, protect people and keep operations running.

We’re currently seeking a Senior Information Security Internal Auditor to join our team. This is a fully remote, home-based role open to candidates located anywhere in the United States.

What you'll do

• Develop and maintain the information security internal audit program within the Compliance portfolio, aligning it with FedRAMP, CMMC and other applicable requirements.
• Maintain Everbridge’s Information Security and Privacy Framework, including its policies, procedures, standards and guidelines.
• Translate framework requirements into clear, testable technical controls and acceptance criteria that engineering teams can implement.
• Partner with Engineering, DevOps and Security to integrate effective controls into existing workflows.
• Own monthly continuous monitoring (ConMon) assessments and submissions.
• Coordinate with Engineering and Operations to deliver CMMC and FedRAMP documentation on time and meet project milestones.
• Serve as a technical point of contact during audits. Explain architecture, data flows and control evidence, and help auditors understand how requirements apply in a cloud environment.
• Represent Compliance in FedRAMP, CMMC and other certification projects and strategy discussions.
• Build and maintain automated evidence collection across cloud platforms, identity providers, CI/CD pipelines and ticketing systems.
• Develop policy-as-code and continuous control monitoring checks using tools such as OPA, Cloud Custodian or AWS Config.
• Own and improve the GRC platform and its integrations.
• Create audit plans and reports, maintain organized documentation and evidence, and establish clear processes and guidelines.

• Develop approaches for continuous monitoring and recertification, support external audits and assist with other audit activities as needed.

What you'll bring:

• At least three years of experience in security, assessments, compliance consulting or advisory work in a highly technical environment.
• At least three years of experience performing or supporting technical assessments for a major compliance effort, such as CMMC, FedRAMP, SOC 2, BSI C5 or ISO 27001.
• Experience with CMMC, DFARS, NIST SP 800-171, FedRAMP, NIST SP 800-53, FISMA or similar governance and compliance frameworks.
• Experience in cloud security, platform engineering or DevSecOps.
• Experience with Infrastructure as Code, such as Terraform, and integrating security tools into CI/CD pipelines.
• Strong understanding of information collection, reporting and documentation processes, including developing status reports, metrics and measures.
• Ability to explain technical risk to non-technical stakeholders and translate audit requirements for engineers, both verbally and in writing.
• Clear communication, strong organization and interpersonal skills, and the ability to take initiative and influence decision-makers.
• A CISSP, CIA, CISA, CySA+, CCSP or ISO 27001 Auditor certification is a plus.
• Must be a U.S. citizen and able to obtain a Secret clearance.

$118,700 - $158,200 a year

#LI-HG1

The reasonably estimated salary for this role at Everbridge ranges from $118,000 - $158,200 and may also include variable compensation. Actual compensation is based on factors such as the candidate's skills, qualifications, and experience. In addition, Everbridge offers a wide range of best in class, comprehensive and inclusive employee benefits for this role including healthcare, dental, parental planning, and mental health benefits, disability income benefits, life and AD&D insurance, a 401(k) plan and match, paid time off, and fitness reimbursements.

Fair Chance Statement US & Canada

We are committed to providing equal employment opportunities in compliance with all applicable Federal, Provincial/State and Local laws, including the California Fair Chance Act and any local County Fair Chance Ordinance (or local equivalent). Pursuant to these and other relevant regulations, we consider qualified applicants with criminal histories in a manner consistent with the law.

For roles subject to background checks, the following material job duties may be affected by an applicant’s criminal history:

- Access to sensitive or confidential information, such as financial records, proprietary data, or client information.

- Management of cash, company funds, or other valuable assets.

- Work in environments requiring heightened security measures.

- Compliance with contractual or regulatory requirements specific to the position.

We evaluate each applicant's criminal history individually, considering its nature, timing, and relevance to the specific job duties, while maintaining our commitment to fair hiring practices and promoting workplace equity.

About Everbridge

Everbridge empowers enterprises and government organizations to anticipate, mitigate, respond to, and recover from critical events. In an unpredictable world, resilient organizations protect their people and operations, adapt under pressure, and return to productivity faster. Our Critical Event Management (CEM) technology combines intelligent automation with comprehensive risk intelligence to help organizations strengthen resilience, keep people safe, and maintain operations.

Equal Employment Opportunity

Everbridge is an Equal Opportunity Employer. We consider all qualified applicants for employment without regard to race, color, creed, religion, national origin, ancestry, age, sex, pregnancy, sexual orientation, gender identity or expression, disability, protected veteran status, genetic information, marital status, or any other characteristic protected by applicable federal, state, or local law.

Employment Practices

Everbridge does not require or administer lie detector (polygraph) tests as a condition of employment or continued employment. In Massachusetts, it is unlawful to require or administer a lie detector test as a condition of employment or continued employment. Employers who violate this law may be subject to criminal penalties and civil liability.