Company Overview:
Arctiq is a global, intelligence-driven technology services company delivering professional and managed services across Hybrid Cloud Infrastructure, Networking & Connected Experiences, Cybersecurity, Data & AI, Autonomous Operations & Intelligence, and Enterprise Service Management. We help organizations operate, secure, and modernize complex environments by unifying infrastructure, networking, data, security, automation, and observability under a single, integrated operating model. Our work focuses on helping customers reduce operational friction, improve resilience, and make better, faster decisions as their environments evolve. Arctiq builds on decades of industry expertise and a customer-centric ethos to deliver exceptional value to clients across diverse industries.
Position Overview:
We are seeking an experienced, independent IT Security Auditor to conduct a confidential, third-party IT security and compliance assessment. This engagement will focus on evaluating IT operations, identifying security and compliance gaps, and assessing adherence to applicable National Institute of Standards and Technology (NIST) standards and guidelines.
The auditor will take a discovery-driven approach to assess the agency’s technology environment, identify potential security risks, and evaluate controls related to unauthorized software, hardware, and network access. This engagement requires an objective external professional who can independently assess the environment, exercise sound judgment, and deliver actionable findings while minimizing disruption to business operations.
This is a two-week onsite assignment in Carson City, NV for one of Arctiq's clients.
Key Responsibilities:
- Conduct a confidential, independent IT security audit of the agency’s technology environment, focusing on IT operations, infrastructure, and security controls rather than individual employee performance.
- Assess compliance with applicable NIST standards and guidelines, including NIST SP 800-53 where appropriate, in accordance with state legislative requirements.
- Evaluate the effectiveness of IT controls and processes across the following areas:
- Patch and vulnerability management
- Configuration management and security baselines
- Identity and access management (IAM)
- IT operations and security controls
- Software and hardware asset management
- Network asset discovery and inventory
- Detection of unauthorized software, hardware, and other potentially unapproved technology
- Perform network and asset discovery scans using auditor-provided tools to identify connected devices, installed software, and potential gaps in asset visibility.
- Investigate potential indicators of security policy violations, control weaknesses, and insider-threat risks through authorized technical assessments and evidence-based analysis.
- Identify areas of compliance and non-compliance, document control deficiencies, assess associated risks, and develop practical recommendations for remediation.
- Coordinate with designated agency personnel and an authorized system administrator to obtain necessary access while avoiding direct interaction with business systems wherever possible.
- Maintain confidentiality, independence, objectivity, and professional discretion throughout the engagement.
- Deliver a comprehensive NIST compliance gap assessment report documenting findings, areas of compliance, deficiencies, risk considerations, and recommended corrective actions.
Required Qualifications:
- Demonstrated experience conducting independent IT security audits, infrastructure assessments, or technology compliance reviews.
- Relevant, recognized security or auditing certification, such as Certified Information Systems Auditor (CISA), ISO/IEC 27001 Lead Auditor, or an equivalent credential.
- Strong working knowledge of NIST cybersecurity standards and control frameworks, including familiarity with NIST SP 800-53.
- Hands-on experience assessing enterprise IT environments, including endpoint and network asset discovery, vulnerability management, configuration management, access controls, and software and hardware inventories.
- Experience identifying unauthorized assets, software, security control deficiencies, and potential compliance violations.
- Ability to independently plan and execute technical assessments using auditor-provided tools and methodologies.
- Excellent analytical, documentation, and report-writing skills, with the ability to communicate technical findings and compliance gaps clearly to executive stakeholders.
- Demonstrated professionalism and discretion when working in confidential, sensitive, or high-accountability environments.
- Ability to maintain an objective, third-party perspective and produce defensible, evidence-based findings.
Engagement Requirements:
- Independence: Must operate as an independent, external third-party auditor.
- Confidentiality: Must be able to conduct a sensitive assessment with strict confidentiality and discretion.
- Tools: Must provide the necessary tools and capabilities to conduct network discovery and IT control assessments.
- On-site access: Must be available to conduct the assessment on-site, with access facilitated by an authorized administrator and designated agency representative.
- Assessment approach: Must be prepared to begin work without advance notification to the agency IT team and adapt to findings as they emerge.
- Scope of work: Focus on IT security controls, operational compliance, and NIST alignment. Formal forensic evidence collection and chain-of-custody procedures are outside the primary scope of this engagement.
- Deliverable: A comprehensive NIST compliance gap report identifying compliant and non-compliant areas, associated risks, and recommended remediation actions.
Preferred Experience:
- Experience conducting security assessments for state or local government agencies or other regulated organizations.
- Experience with confidential or sensitive IT audits involving suspected insider threats or potential unauthorized technology.
- Familiarity with network scanning, asset discovery, vulnerability assessment, and security configuration assessment tools.
- Experience presenting sensitive technical findings and remediation recommendations to senior leadership.
Arctiq is an equal opportunity employer. If you need any accommodations or adjustments throughout the interview process and beyond, please let us know. We celebrate our inclusive work environment and welcome members of all backgrounds and perspectives to apply.
We thank you for your interest in joining the Arctiq team! While we welcome all applicants, only those who are selected for an interview will be contacted.