Security Compliance Engineer

Altarum is hiring a Security Compliance Engineer to own its security compliance and assurance program, combining governance, risk, and compliance with hands-on security operations and engineering. The role supports audit readiness, client authorizations, continuous monitoring, cloud and DevOps security, incident response, and AI security governance.

Responsibilities:

• Work with the SAG and Senior Cybersecurity Policy Advisor to maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), the Incident Response (IR) Plan, and related policies, procedures, and evidence
• Prepare ATO packages and serve as the primary point of contact for client security offices, third-party assessors (3PAOs and C3PAOs), and auditors
• Within the SAG's existing process, maintain our NIST SP 800-171 self-assessment and SPRS score, keeping evidence audit-ready for CMMC and client assessments
• Track compliance with federal (FedRAMP, CMMC) and state (TX-RAMP, StateRAMP/GovRAMP) security programs for platforms serving government clients
• Support proposals from a security perspective: review solicitation security requirements, write security and compliance sections, and answer client and vendor security questionnaires from a maintained, reusable response library
• Run an ongoing continuous monitoring program across in-scope systems, including periodic control checks, scan review, and POA&M updates
• Conduct internal control assessments and readiness reviews ahead of external assessments
• Report compliance posture to leadership on a regular cadence, with clear metrics, trends, and risk-based recommendations
• Manage our vendor-maintained SOC, Managed Detection and Response (MDR) service, and SIEM (24/7/365), including detection tuning, escalations, service performance, and reporting
• Run the vulnerability and patch management program, coordinating fixes with system administrators, developers, and vendors and verifying closure within defined timelines
• Conduct regular access reviews across all environments, enforcing least privilege for users and privileged accounts
• Review changes for security impact through our change enablement process
• Review the security posture of new platforms, vendors, and subcontractors before onboarding, and monitor them for supply chain risk, flow-down requirements, and current FedRAMP or state authorizations
• Partner with the PHT team to build security controls into CI/CD pipelines, such as automated vulnerability scanning, secrets management, and dependency checks
• Review infrastructure-as-code (Terraform, CloudFormation, or similar) and cloud configurations in AWS, Azure, Oracle, and other cloud environments against compliance baselines, and recommend hardening
• Support secure configuration and monitoring of cloud environments used for client system delivery
• Advise on container and image security practices where applicable
• Serve as the security and compliance point of contact in the PHT team's working cadence, including sprint reviews, change management, and release planning
• Support incident response, including triage coordination with the MDR, SIEM, and other relevant vendors; coordinating containment with system administrators and engineers; documentation and evidence preservation; and client notification and required government reporting
• Facilitate IR tabletop exercises and feed after-action improvements back into the IR Plan
• Maintain an inventory of approved AI tools, monitor for unapproved use, and apply data loss protections so PHI, PII, and CUI don't reach unapproved services
• Support AI vendor risk reviews and align AI practices with the NIST AI RMF and NIST's draft SP 800-53 control overlays for AI systems

Requirements:

• 5+ years in information security, including at least 2 years in a compliance-focused role supporting NIST 800-171, NIST 800-53, FedRAMP, or HIPAA
• Familiarity with cloud infrastructure security in AWS, Oracle, and/or Azure
• CompTIA Security+ or a higher certification, such as SSCP, CGRC (formerly CAP), CISSP, or CISM
• Bachelor's degree in a related field, or equivalent experience
• U.S. citizenship and the ability to obtain and maintain Public Trust eligibility
• Candidates must be currently eligible to work in the United States; sponsorship is not available
• CMMC Certified Professional (CCP), or willingness to obtain it within 12 months of hire
• A cloud security certification, such as AWS Certified Security – Specialty or Microsoft Azure Security Engineer Associate
• Experience in consulting, professional services, or government contracting serving healthcare, state, or federal clients
• Experience with federal or state security programs such as FedRAMP, CMMC, TX-RAMP, or StateRAMP (now GovRAMP)
• Hands-on experience with CI/CD tooling (GitHub Actions, GitLab CI, or Jenkins) and infrastructure-as-code (Terraform, CloudFormation, or Puppet)
• Experience with a GRC platform and with scripting (PowerShell, Python, or Bash) to automate evidence collection and reporting