Security Compliance Engineer

Altarum•Novi, MI

8d•$100,207 - $120,939•Hybrid

About The Position

This role involves owning Altarum's security compliance and assurance program, blending governance, risk, and compliance (GRC) with hands-on security operations and engineering. The position is crucial for protecting Personally Identifiable Information (PII), Protected Health Information (PHI), and Controlled Unclassified Information (CUI), ensuring that work is defensible and audit-ready. The Security Compliance Engineer will report to the Director of Security and Technology, collaborate with the Security Advisory Group (SAG) and Senior Cybersecurity Policy Advisor, support client Authority to Operate (ATO) efforts, and act as the security and compliance partner to the Public Health Technology (PHT) team. The role will encompass various frameworks including NIST SP 800-171 and CMMC Level 2, NIST SP 800-53 Rev 5, FedRAMP Low and Moderate, TX-RAMP and StateRAMP (now GovRAMP), the HIPAA Security Rule, and the NIST AI Risk Management Framework, with day-to-day practices aligning with ITIL 4.

Requirements

5+ years in information security, including at least 2 years in a compliance-focused role supporting NIST 800-171, NIST 800-53, FedRAMP, or HIPAA.
Familiarity with cloud infrastructure security in AWS, Oracle, and/or Azure.
CompTIA Security+ or a higher certification, such as SSCP, CGRC (formerly CAP), CISSP, or CISM.
Bachelor's degree in a related field, or equivalent experience.
U.S. citizenship and the ability to obtain and maintain Public Trust eligibility.

Nice To Haves

CMMC Certified Professional (CCP), or willingness to obtain it within 12 months of hire.
A cloud security certification, such as AWS Certified Security – Specialty or Microsoft Azure Security Engineer Associate.
Experience in consulting, professional services, or government contracting serving healthcare, state, or federal clients.
Experience with federal or state security programs such as FedRAMP, CMMC, TX-RAMP, or StateRAMP (now GovRAMP).
Hands-on experience with CI/CD tooling (GitHub Actions, GitLab CI, or Jenkins) and infrastructure-as-code (Terraform, CloudFormation, or Puppet).
Experience with a GRC platform and with scripting (PowerShell, Python, or Bash) to automate evidence collection and reporting.

Responsibilities

Maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), the Incident Response (IR) Plan, and related policies, procedures, and evidence.
Prepare ATO packages and serve as the primary point of contact for client security offices, third-party assessors (3PAOs and C3PAOs), and auditors.
Maintain NIST SP 800-171 self-assessment and SPRS score, keeping evidence audit-ready for CMMC and client assessments.
Track compliance with federal (FedRAMP, CMMC) and state (TX-RAMP, StateRAMP/GovRAMP) security programs for platforms serving government clients.
Support proposals from a security perspective, including reviewing solicitation security requirements, writing security and compliance sections, and answering client and vendor security questionnaires.
Run an ongoing continuous monitoring program across in-scope systems, including periodic control checks, scan review, and POA&M updates.
Conduct internal control assessments and readiness reviews ahead of external assessments.
Report compliance posture to leadership on a regular cadence, with clear metrics, trends, and risk-based recommendations.
Manage the vendor-maintained SOC, Managed Detection and Response (MDR) service, and SIEM (24/7/365), including detection tuning, escalations, service performance, and reporting.
Run the vulnerability and patch management program, coordinating fixes with system administrators, developers, and vendors and verifying closure within defined timelines.
Conduct regular access reviews across all environments, enforcing least privilege for users and privileged accounts.
Review changes for security impact through the change enablement process.
Review the security posture of new platforms, vendors, and subcontractors before onboarding, and monitor them for supply chain risk, flow-down requirements, and current FedRAMP or state authorizations.
Partner with the PHT team to build security controls into CI/CD pipelines, such as automated vulnerability scanning, secrets management, and dependency checks.
Review infrastructure-as-code (Terraform, CloudFormation, or similar) and cloud configurations in AWS, Azure, Oracle, and other cloud environments against compliance baselines, and recommend hardening.
Support secure configuration and monitoring of cloud environments used for client system delivery.
Advise on container and image security practices where applicable.
Serve as the security and compliance point of contact in the PHT team's working cadence, including sprint reviews, change management, and release planning.
Support incident response, including triage coordination with the MDR, SIEM, and other relevant vendors; coordinating containment with system administrators and engineers; documentation and evidence preservation; and client notification and required government reporting.
Facilitate IR tabletop exercises and feed after-action improvements back into the IR Plan.
Maintain an inventory of approved AI tools, monitor for unapproved use, and apply data loss protections so PHI, PII, and CUI don't reach unapproved services.
Support AI vendor risk reviews and align AI practices with the NIST AI RMF and NIST's draft SP 800-53 control overlays for AI systems.