Cybersecurity & Compliance Auditor

The Cybersecurity and Compliance Auditor subcontract for the California Department of Cannabis Control involves performing security assessments and penetration testing for prime contractors. The selected provider will be responsible for verifying SOC 2 Type II compliance, auditing FIPS 140-3 cryptography, and utilizing SIEM tools to monitor system events for potential attacks. Additionally, the role requires conducting security incident investigations and applying expertise in OWASP standards to ensure robust system security. Key deliverables for this engagement include comprehensive penetration test results, a detailed Security Plan, and formal Security Audit reports. The opportunity was posted on June 19, 2026, with a response deadline of April 14, 2027. This subcontract falls under NAICS code 541519 and is managed through the California state procurement system.