Security Compliance Engineer

At Altarum, we're driven by a simple but powerful mission: improving the health of individuals with fewer financial resources and populations underserved by the healthcare system. You will own Altarum's security compliance and assurance program. The role blends governance, risk, and compliance (GRC) with hands-on security operations and engineering. You will report to the Director of Security and Technology, work closely with the Security Advisory Group (SAG) and Senior Cybersecurity Policy Advisor, support client Authority to Operate (ATO) efforts, and serve as the security and compliance partner to the Public Health Technology (PHT) team.

Responsibilities

Maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), the Incident Response (IR) Plan, and related policies, procedures, and evidence; Prepare ATO packages and serve as the primary point of contact for client security offices, third-party assessors, and auditors; Maintain the NIST SP 800-171 self-assessment and SPRS score; Track compliance with federal and state security programs for platforms serving government clients; Support proposals from a security perspective and answer client and vendor security questionnaires; Run a continuous monitoring program across in-scope systems; Conduct internal control assessments and readiness reviews; Report compliance posture to leadership on a regular cadence; Manage the vendor-maintained SOC, MDR service, and SIEM; Run the vulnerability and patch management program; Conduct regular access reviews enforcing least privilege; Review changes for security impact; Review the security posture of new platforms, vendors, and subcontractors; Partner with the PHT team to build security controls into CI/CD pipelines; Review infrastructure-as-code and cloud configurations against compliance baselines; Support incident response and facilitate IR tabletop exercises; Maintain an inventory of approved AI tools and apply data loss protections; Support AI vendor risk reviews and align AI practices with the NIST AI RMF

Requirements

5+ years in information security, including at least 2 years in a compliance-focused role supporting NIST 800-171, NIST 800-53, FedRAMP, or HIPAA; Familiarity with cloud infrastructure security in AWS, Oracle, and/or Azure; CompTIA Security+ or a higher certification, such as SSCP, CGRC (formerly CAP), CISSP, or CISM; Bachelor's degree in a related field, or equivalent experience; U.S. citizenship and the ability to obtain and maintain Public Trust eligibility

Nice to have

CMMC Certified Professional (CCP), or willingness to obtain it within 12 months of hire; A cloud security certification, such as AWS Certified Security – Specialty or Microsoft Azure Security Engineer Associate; Experience in consulting, professional services, or government contracting serving healthcare, state, or federal clients; Experience with federal or state security programs such as FedRAMP, CMMC, TX-RAMP, or StateRAMP (now GovRAMP); Hands-on experience with CI/CD tooling (GitHub Actions, GitLab CI, or Jenkins) and infrastructure-as-code (Terraform, CloudFormation, or Puppet); Experience with a GRC platform and with scripting (PowerShell, Python, or Bash) to automate evidence collection and reporting