Program Manager & Lead Cybersecurity/IT Audit SME

Program Manager & Lead Cybersecurity/IT Audit SME

Reports To: OCIG Contract Manager

Supports: Deliverables 1, 2 (technical direction), 5, and overall contract administration

Certifications: PMP required; CISA and/or CISSP required

Experience: 8+ years leading government or audit-related professional services engagements, including 5+ years hands-on cybersecurity/IT audit work

Allocation: Full-time for kickoff/mobilization and planning milestones; ongoing oversight thereafter

Consolidates Original Roles

Project Manager / Engagement Lead + Lead Cybersecurity & IT Audit Subject Matter Expert + Audit Planning & Risk Advisor (planning-lead functions)

Role Summary

This is the engagement's single point of accountability and its senior technical authority. The individual runs the Kickoff Meeting and Master Project Plan, sets the technical direction for the standardized audit program and framework alignment (NIST CSF, ISO 27001, NIST 800-53A, COSO, SOC 2, CIS Controls, Rule 60GG-2, F.A.C.), leads audit planning support, and owns all contractual, invoicing, and change-order administration - eliminating the coordination overhead of a separate PM and Lead SME.

Key Responsibilities

• Plan and facilitate the Project Kickoff Meeting and produce draft/final Kickoff Minutes, the Master Project Plan, Agency Risk Understanding Memorandum, and Communication Plan.
• Set and quality-check the technical approach for the standardized audit program (Deliverable 2), directing the Audit Program & Training Delivery Specialist on build-out.
• Lead Audit Planning Support (Deliverable 5): facilitate planning workshops, produce the annual strategic audit roadmap and prioritized, NIST CSF-mapped risk inventory.
• Serve as primary liaison to the OCIG Contract Manager for all contractual matters, staffing changes, and change orders; manage invoicing per Section 11.0.
• Provide evidence-based conclusions and recommendations to C-suite/Board/Senior Management audiences as required by Section 7.0.
• Serve as final escalation point for the Advisory Support & Program Analyst on complex mailbox inquiries.
• Monitor deliverable status and cost against the $500,000 not-to-exceed ceiling to avoid the financial consequences in Section 5.0 of Attachment A.

Required Qualifications

• Active PMP certification and active CISA or CISSP certification.
• Minimum 5 years of experience supporting or conducting audits or compliance reviews in a government setting (Section 7.0).
• Documented, hands-on experience applying NIST CSF, including risk management, gap analysis, and control assessment.
• Demonstrated ability to manage firm fixed-price, deliverable-based government contracts.
• U.S. citizen or authorized to work in the U.S.; able to travel periodically to Tallahassee, FL.

Preferred Qualifications

• Familiarity with Rule 60GG-2, F.A.C., and prior experience with a state or federal Office of Inspector General.
• Working knowledge of GAO Government Auditing Standards (Yellow Book) and IIA International Standards (Red Book).