Security Compliance Engineer

Altarum•Novi, MI

24d•Hybrid

About The Position

Altarum is hiring a Security Compliance Engineer to own its security compliance and assurance program. The role combines governance, risk, and compliance with hands-on security operations and engineering to protect PII, PHI, and CUI and keep the organization’s security practices defensible and audit-ready. The position reports to the Director of Security and Technology and works with the Security Advisory Group, the Senior Cybersecurity Policy Advisor, client security offices, assessors, auditors, and the Public Health Technology team. It supports client Authority to Operate efforts and serves as the security and compliance partner to the PHT team. The role covers NIST SP 800-171 and CMMC Level 2, NIST SP 800-53 Rev. 5, FedRAMP Low and Moderate, TX-RAMP and StateRAMP/GovRAMP, the HIPAA Security Rule, and the NIST AI Risk Management Framework. Day-to-day practices align with ITIL 4. Responsibilities include maintaining compliance documentation and authorization packages, running continuous monitoring and control assessments, managing vendor-provided security services and vulnerability programs, integrating security into cloud and DevOps workflows, supporting incident response, and advancing AI security and governance. The position is hybrid in Novi, Michigan. Employees near Altarum offices in Arlington, Virginia; Silver Spring, Maryland; or Novi, Michigan attend an in-person collaboration day once every other month. Non-local employees join virtually and may occasionally be asked to attend in person. Travel is under 10%. Candidates must be eligible to work in the United States without sponsorship, and work must be performed within the continental U.S. unless a contract requires otherwise. Core hours are aligned with Eastern Time unless otherwise approved. Remote employees must maintain a dedicated, ergonomically appropriate workspace with reliable internet and a suitable mobile device.

Requirements

At least 5 years of experience in information security, including at least 2 years in a compliance-focused role supporting NIST 800-171, NIST 800-53, FedRAMP, or HIPAA.
Familiarity with cloud infrastructure security in AWS, Oracle, and/or Azure.
CompTIA Security+ or a higher certification, such as SSCP, CGRC (formerly CAP), CISSP, or CISM.
Bachelor’s degree in a related field or equivalent experience.
U.S. citizenship and ability to obtain and maintain Public Trust eligibility.
Currently eligible to work in the United States; sponsorship is not available.
Ability to perform all work within the continental U.S. for the duration of employment, unless required otherwise by contract.
Ability to work core hours aligned with Eastern Time unless otherwise approved by the manager.
Remote employees must maintain a dedicated, ergonomically appropriate workspace free from distractions, reliable internet, and a mobile device that supports efficient work.

Nice To Haves

CMMC Certified Professional (CCP), or willingness to obtain it within 12 months of hire.
A cloud security certification, such as AWS Certified Security – Specialty or Microsoft Azure Security Engineer Associate.
Experience in consulting, professional services, or government contracting serving healthcare, state, or federal clients.
Experience with federal or state security programs such as FedRAMP, CMMC, TX-RAMP, or StateRAMP/GovRAMP.
Hands-on experience with CI/CD tooling such as GitHub Actions, GitLab CI, or Jenkins, and infrastructure-as-code such as Terraform, CloudFormation, or Puppet.
Experience with a GRC platform and scripting in PowerShell, Python, or Bash to automate evidence collection and reporting.

Responsibilities

Maintain System Security Plans, Plans of Action and Milestones, the Incident Response Plan, related policies and procedures, and supporting evidence with the Security Advisory Group and Senior Cybersecurity Policy Advisor.
Prepare Authority to Operate packages and serve as the primary point of contact for client security offices, third-party assessors, and auditors.
Maintain the NIST SP 800-171 self-assessment and SPRS score within the Security Advisory Group’s process, keeping evidence audit-ready for CMMC and client assessments.
Track compliance with federal and state security programs for platforms serving government clients, including FedRAMP, CMMC, TX-RAMP, and StateRAMP/GovRAMP.
Support proposals by reviewing solicitation security requirements, writing security and compliance sections, and answering client and vendor security questionnaires using a maintained response library.
Run continuous monitoring across in-scope systems, including periodic control checks, scan review, and POA&M updates.
Conduct internal control assessments and readiness reviews before external assessments.
Report compliance posture to leadership regularly using metrics, trends, and risk-based recommendations.
Manage the vendor-maintained SOC, MDR service, and SIEM, including detection tuning, escalations, service performance, and reporting.
Run the vulnerability and patch management program, coordinate fixes with system administrators, developers, and vendors, and verify closure within defined timelines.
Conduct regular access reviews across environments and enforce least privilege for user and privileged accounts.
Review changes for security impact through the change enablement process.
Review the security posture of new platforms, vendors, and subcontractors before onboarding, and monitor supply chain risk, flow-down requirements, and current FedRAMP or state authorizations.
Partner with the Public Health Technology team to build security controls into CI/CD pipelines, including automated vulnerability scanning, secrets management, and dependency checks.
Review infrastructure-as-code and cloud configurations in AWS, Azure, Oracle, and other cloud environments against compliance baselines, and recommend hardening.
Support secure configuration and monitoring of cloud environments used for client system delivery.
Advise on container and image security practices where applicable.
Serve as the security and compliance point of contact in the PHT team’s working cadence, including sprint reviews, change management, and release planning.
Support incident response, including triage coordination with the MDR, SIEM, and other vendors; containment coordination with administrators and engineers; documentation and evidence preservation; and client notification and required government reporting.
Facilitate incident response tabletop exercises and incorporate after-action improvements into the Incident Response Plan.
Maintain an inventory of approved AI tools, monitor for unapproved use, and apply data loss protections to prevent PHI, PII, and CUI from reaching unapproved services.
Support AI vendor risk reviews and align AI practices with the NIST AI Risk Management Framework and NIST’s draft SP 800-53 control overlays for AI systems.