Federal Information Assurance & Compliance Lead

Peraton; Herndon (VA); On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton seeks an Information Assurance and Security Advisor to lead regulatory and compliance activities for CMS FPS vendor evaluation, producing security inputs to the POC proposal and ensuring all data paths and artifacts stay within the FPS ATO boundary and CMS guidance.

You will own SSP/POA&M/PIA inputs, coordinate with FPS ISSO/ISSM and CMS stakeholders, and advise on model-provider data retention and prompt logging. US citizenship and Public Trust eligibility required.

Qualifications

• Minimum 8 years with BS/BA; Minimum 6 years with MS/MA; Minimum 3 years with PhD
• Experience leading compliance work on Federal systems, ideally CMS
• Deep knowledge of CMS security frameworks and ATO lifecycle (SSP, SAR, POA&M)
• Familiarity with FISMA/NIST SP 800-53 tailoring and cloud inheritance (AWS FedRAMP)
• Experience assessing third-party/vendor security posture (SOC 2, FedRAMP, HIPAA/HITRUST)
• Strong written communication for CMS-level reviews

Responsibilities

• Assess CMS FPS vendor against CMS security posture and ATO requirements
• Author security inputs to POC Solution proposal and data-flow diagrams
• Coordinate with FPS ISSO/ISSM and CMS security stakeholders
• Own SSP inputs, POA&M entries, and PIA/SORN as applicable
• Serve as single point of contact for security/compliance questions from vendors and CMS
• Advise on LLM/agentic-AI compliance concerns (data retention, logging, prompts)

Skills

CMS security frameworks

FISMA/NIST SP 800-53

Cloud security (AWS FedRAMP)

HIPAA PHI handling

Regulatory compliance

Vendor risk assessment

CMS ATO lifecycle

Education

BS/BA

MS/MA

PhD

Tools

AWS

Okta SSO/RBAC

CloudWatch/Splunk

KMS/GuardDuty

Job description

Peraton seeks an Information Assurance and Security Advisor to lead regulatory and compliance activities for CMS FPS vendor evaluation, producing security inputs to the POC proposal and ensuring all data paths and artifacts stay within the FPS ATO boundary and CMS guidance.

You will own SSP/POA&M/PIA inputs, coordinate with FPS ISSO/ISSM and CMS stakeholders, and advise on model-provider data retention and prompt logging. US citizenship and Public Trust eligibility required.