Open role

Cybersecurity Compliance Auditor (ISO 27001 and CMMC)

Review cybersecurity controls and evidence for ISO 27001, CMMC, and related frameworks. Write clear findings and support MedTech teams with audit preparation.

All open roles

Reports to: [INPUT NEEDED: auditor reporting manager]
Status: Full-time employee
Location: Remote (United States)
Compensation: [INPUT NEEDED: auditor compensation and benefits]
Equipment: [INPUT NEEDED: auditor equipment arrangements]

The job in 30 seconds

Review control design, implementation, and supporting evidence. Distinguish an implemented control from a policy statement.
Work across ISO 27001, CMMC, and other frameworks within the agreed engagement scope and your qualifications.
Formal certification audits and CMMC assessments require the applicable organizational authorization and individual credentials.

About the role

We are looking for a cybersecurity auditor who can turn framework requirements into practical evidence requests, focused interviews, and defensible findings. You will support medical device and healthcare technology teams with scoped audits, internal reviews, and readiness assessments.

ISO 27001 and CMMC are core areas for this role. Related work may involve NIST SP 800-171, NIST Cybersecurity Framework, SOC 2 readiness, and healthcare security requirements when relevant to the client and agreed scope. A crosswalk helps organize evidence; it does not make different frameworks interchangeable.

This opening does not claim that Blue Goat is an accredited certification body or authorized CMMC assessment organization. Formal certification or assessment activity must remain within the applicable authorization, independence requirements, and credentials. SOC 2 attestation is performed by an eligible CPA firm, not by this role alone.

You are a fit if

Evidence before conclusions

You ask who performs a control, where its records live, and whether the evidence supports the period and scope being assessed.
You explain a finding without overstating certainty or promising certification.
You keep audit independence, confidentiality, and conflicts of interest visible.

What you will own

Audit planning and evidence review

Agree on framework, version, boundaries, assessment type, evidence period, and exclusions before work begins.
Build evidence requests, interview process owners, and review implementation against the applicable criteria.
Document sampling, limitations, contradictions, and missing evidence without treating gaps as proven compliance.

Findings and follow-up

Write findings with the criterion, evidence, observed gap, and recommended next step.
Review corrective-action evidence within the agreed scope. The client owns implementation and risk decisions.
Separate advisory recommendations, internal audit conclusions, and formal third-party assessment decisions.

Client communication and independence

Explain findings to technical, quality, and leadership teams in plain language.
Disclose conflicts and avoid independently auditing work you implemented where independence rules prohibit it.
Keep client evidence private and use only authorized systems and access.

Required skills and experience

Hands-on experience auditing cybersecurity controls or conducting evidence-based readiness assessments.
Working knowledge of ISO/IEC 27001 and CMMC requirements and their distinct audit or assessment processes.
Ability to evaluate policies, technical settings, interviews, and operating records against defined criteria.
Clear audit writing, evidence traceability, and professional client communication.
Ability to handle confidential information using approved access and storage arrangements.

Preferred experience

ISO/IEC 27001 auditor or lead auditor training and documented audit experience.
Relevant CMMC professional or assessor credentials, with the scope and status of those credentials stated accurately.
CISA, CISSP, or comparable security and assurance experience.
Experience with NIST SP 800-171, SOC 2 readiness, or healthcare security assessments.
Experience working with medical device manufacturers and their quality or supplier oversight teams.

Your first 90 days

What success looks like early on, so you know what you are walking into.

1
First 30 days
- Review the team's audit methods, confidentiality rules, and engagement boundaries.
2
Days 30 to 60
- Contribute evidence review and findings to a scoped engagement with peer review.
3
Days 60 to 90
- Own agreed audit work and improve the clarity and traceability of evidence requests and reports.

Tools we use

Framework requirements and assessment guides
Evidence registers and control crosswalks
Client-approved document and project tools

About Blue Goat Cyber

Blue Goat Cyber is a medical device cybersecurity company dedicated to protecting patient lives by securing the technologies that power modern healthcare. We support medical device manufacturers as they build, test, and launch secure devices that meet FDA expectations and operate safely in the real world.

We are a remote, high-trust, high-ownership team that values clear communication, rigorous thinking, proactive problem solving, continuous learning, and attention to critical details. We expect every team member to own their work, communicate clearly, and support the mission without ego.

Before you apply

The terms every person here works under. Read them now rather than at offer stage, along with our core values and the open-role requirements. See also what excellence looks like here, the eight standards we hire against.

Work authorization

You must be authorized to work in the United States. We do not sponsor visas for these roles.
All roles are performed from within the United States.

Confidentiality and NDA

You will sign a mutual nondisclosure agreement before you see any client material, and client-specific NDAs where a client requires one.
You will see unreleased device designs, firmware, source code, vulnerabilities, and submission content. None of it is yours to discuss, publish, screenshot, or reference, during or after the engagement.
Client material stays in company systems. No personal cloud storage, personal email, personal repositories, or unvetted AI tools.
Anything we publish that draws on client work is anonymized and cleared with the client first.

How we expect you to use AI

Use AI every day if it helps, on the company ChatGPT and Claude accounts we provide, and keep client material inside them: firmware, source code, submission documents, findings, and client names never go anywhere else.
You own the accuracy of anything you send out, because models get recognition numbers, clause references, and test conclusions wrong in ways that read perfectly well. The full policy is in the careers FAQ.

Security and background

Offers are contingent on a background check and on reference checks.
You will use company-required security controls on any device that touches client data, including full-disk encryption, screen lock, and our password manager and multi-factor authentication.
Report a suspected compromise or data exposure immediately. We treat honest, fast reporting as the right behavior, not a fault.
Some client engagements require additional screening or training before you can be assigned.

Equal opportunity

Blue Goat Cyber is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other protected characteristic.
If you need an accommodation at any point in the hiring process, tell us and we will arrange it.

Apply

All applicants must complete the application form on our careers page. Include your resume or work-history links, a short fit statement, and one role-specific scenario answer. A real person on our team reads every application.

Apply for this role

If you do not hear back within two weeks, we have decided not to move forward for now. We keep applications on file for future openings.