AI Vendor Security & Compliance Lead

Peraton; United States; On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton seeks a Regulatory and Compliance Lead for the CMS Fraud Prevention Services (FPS) team. You will serve as the compliance authority for the agentic AI vendor evaluation, producing regulatory inputs and authoring security documentation to keep activities within the FPS ATO boundary.

You will coordinate with CMS and FPS stakeholders, own artifacts like SSP/POA&M/PIA-SORN, and advise on PHI controls and data retention in LLM contexts.

Qualifications

• Minimum 8 years with BS/BA; 6 years with MS/MA; 3 years with PhD.
• Experience leading compliance on Federal systems (CMS preferred).
• Knowledge CMS security frameworks: CFACTS, CSRAP, ATO lifecycle.
• FISMA / NIST SP 800-53 tailoring and cloud-provider inheritance.
• Experience assessing third-party security posture (SOC 2, FedRAMP, HIPAA/HITRUST).
• US citizenship and ability to obtain Public Trust clearance.

Responsibilities

• Assess candidate agentic AI vendors against CMS security posture and ATO requirements.
• Author security-and-compliance inputs to the POC Solution proposal.
• Coordinate with FPS ISSO/ISSM and CMS security stakeholders to stay inside FPS ATO boundary.
• Own SSP inputs, POA&M entries, PIA/SORN for the AI vendor-evaluation effort.
• Serve as single point of contact for security-and-compliance questions from vendors and CMS.
• Advise on LLM/agentic-AI compliance concerns (data retention, prompt logging, PHI controls).

Skills

CMS security frameworks

Regulatory compliance

Security risk assessment

Technical writing

Stakeholder coordination

Federal systems experience

Education

BS/BA in relevant field

MS/MA

PhD

Tools

AWS

FedRAMP

Splunk

CloudWatch

Okta

KMS

Job description

Peraton seeks a Regulatory and Compliance Lead for the CMS Fraud Prevention Services (FPS) team. You will serve as the compliance authority for the agentic AI vendor evaluation, producing regulatory inputs and authoring security documentation to keep activities within the FPS ATO boundary.

You will coordinate with CMS and FPS stakeholders, own artifacts like SSP/POA&M/PIA-SORN, and advise on PHI controls and data retention in LLM contexts.