Security Compliance Engineer

Altarum Institute Security Compliance Engineer At Altarum, we're driven by a simple but powerful mission: improving the health of individuals with fewer financial resources and populations underserved by the healthcare system. We partner with federal and state agencies to design and deliver solutions that make a real, measurable difference. ### About the Role You will own Altarum's security compliance and assurance program. The role blends governance, risk, and compliance (GRC) with hands-on security operations and engineering. We protect Personally Identifiable Information (PII), Protected Health Information (PHI), and Controlled Unclassified Information (CUI) every day, and you will help make sure that work is defensible and audit-ready. You will report to the Director of Security and Technology. You'll work closely with our Security Advisory Group (SAG) and Senior Cybersecurity Policy Advisor, support client Authority to Operate (ATO) efforts, and serve as the security and compliance partner to our Public Health Technology (PHT) team. You will work across these frameworks: NIST SP 800-171 and CMMC Level 2, NIST SP 800-53 Rev 5, FedRAMP Low and Moderate, TX-RAMP and StateRAMP (now GovRAMP), the HIPAA Security Rule, and the NIST AI Risk Management Framework. Day-to-day practices align with ITIL 4. ### What You'll Do Compliance documentation and authorization support - Work with the SAG and Senior Cybersecurity Policy Advisor to maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), the Incident Response (IR) Plan, and related policies, procedures, and evidence - Prepare ATO packages and serve as the primary point of contact for client security offices, third-party assessors (3PAOs and C3PAOs), and auditors - Within the SAG's existing process, maintain our NIST SP 800-171 self-assessment and SPRS score, keeping evidence audit-ready for CMMC and client assessments - Track compliance with federal (FedRAMP, CMMC) and state (TX-RAMP, StateRAMP/GovRAMP) security programs for platforms serving government clients - Support proposals from a security perspective: review solicitation security requirements, write security and compliance sections, and answer client and vendor security questionnaires from a maintained, reusable response library Continuous monitoring and control assessment - Run an ongoing continuous monitoring program across in-scope systems, including periodic control checks, scan review, and POA&M updates - Conduct internal control assessments and readiness reviews ahead of external assessments - Report compliance posture to leadership on a regular cadence, with clear metrics, trends, and risk-based recommendations Security operations - Manage our vendor-maintained SOC, Managed Detection and Response (MDR) service, and SIEM (24/7/365), including detection tuning, escalations, service performance, and reporting - Run the vulnerability and patch management program, coordinating fixes with system administrators, developers, and vendors and verifying closure within defined timelines - Conduct regular access reviews across all environments, enforcing least privilege for users and privileged accounts - Review changes for security impact through our change enablement process - Review the security posture of new platforms, vendors, and subcontractors before onboarding, and monitor them for supply chain risk, flow-down requirements, and current FedRAMP or state authorizations DevOps and engineering support Partner with the PHT team to build security controls into CI/CD pipelines, such as automated vulnerability scanning, secrets management, and dependency checks Review infrastructure-as-code (Terraform, CloudFormation, or similar) and cloud c