Hybrid Security & Compliance Engineer (Federal & HIPAA)

Altarum Institute; Novi (MI); Hybrid; USD 100.000 - 121.000; Vollzeit

Zusammenfassung

Altarum Institute in Novi, MI is seeking a Security Compliance Engineer to own our security governance, risk, and compliance program across government and health tech platforms. This hybrid role reports to the Director of Security and Technology and partners with SAG and the PHT team to build auditable controls.

You will maintain SSPs, POA&Ms, and the IR plan, lead ATO efforts, track NIST and FedRAMP readiness, and shape CI/CD security through IaC reviews and vulnerability management—ensuring

Qualifikationen

• 5+ years in information security with a focus on NIST 800-171/800-53, FedRAMP, or HIPAA.
• Experience with cloud security in AWS, Oracle, or Azure.
• Bachelor's degree or equivalent experience.
• U.S. citizenship and ability to obtain Public Trust.

Aufgaben

• Maintain SSPs, POA&Ms, IR plan and related policies and evidence.
• Prepare ATO packages and liaise with client security offices and auditors.
• Track NIST 800-171 SPRS score and audit readiness for CMMC and client assessments.
• Ensure compliance across FedRAMP, CMMC, TX-RAMP, and StateRAMP for government platforms.
• Support security questionnaire responses with a reusable library.

Kenntnisse

InfoSec

Compliance

GRC

Cloud security

AWS

Azure

Oracle

Security+ cert

Bachelor's degree

U.S. citizenship

Ausbildung

Bachelor's degree or equivalent

Tools

Terraform

CloudFormation

Puppet

GitHub Actions

GitLab CI

Jenkins

PowerShell

Python

Bash

Jobbeschreibung

Altarum Institute in Novi, MI is seeking a Security Compliance Engineer to own our security governance, risk, and compliance program across government and health tech platforms. This hybrid role reports to the Director of Security and Technology and partners with SAG and the PHT team to build auditable controls.

You will maintain SSPs, POA&Ms, and the IR plan, lead ATO efforts, track NIST and FedRAMP readiness, and shape CI/CD security through IaC reviews and vulnerability management—ensuring