Information Privacy and Security, Advisor

Peraton; Woodlawn (MD); On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton is seeking a Security Advisor to lead security engineering, governance, risk and compliance for a federal program. You will oversee day-to-day security operations, uphold NIST RMF, HIPAA/ARS, and CMS requirements, and drive continuous security improvement across cloud, on-premise, and integration workstreams.

You will partner with program leadership to maintain ATO, safeguard PHI/PII, and deliver compliant services at scale, while coordinating audits and incident response activities.

Qualifications

• Experience in cybersecurity across engineering, compliance, and operations.
• 3+ years in security leadership/management on federal programs.
• Hands-on with SIEM/EDR, vulnerability management, and cloud security (AWS GovCloud/Azure Government).
• Strong documentation (SSP, SAR, POA&M) and audit engagement.

Responsibilities

• Own security architecture and control implementation across apps, infra, and cloud per NIST SP 800-53 baselines.
• Drive vulnerability management and configuration baselines (DISA STIGs, CIS, SCAP).
• Lead RMF activities including SSP, assessment, POA&M, and continuous monitoring.
• Ensure HIPAA CMS ARS, 45 CFR 164, and HHS policies compliance.
• Coordinate audits, evidence collection, and control testing.
• Lead incident response for PHI/PII incidents; triage, containment, and forensics.
• Manage access control, MFA, backups, DR tests, and monitoring dashboards.
• Enforce data classification, encryption, and key management for CMS/HHS.
• Contribute to risk registers and monthly security status updates for CMS.
• Translate security concepts for technical and non-technical audiences.
• Collaborate with PM, Engineering, QA, Operations, and CMS teams.
• Contribute to security requirements for renewals and bids.

Skills

Security leadership

RMF/NIST knowledge

Cloud security

Threat vulnerability

Documentation

Education

BS/BA

MS/MA

PhD

Tools

SIEM/EDR

AWS GovCloud

Azure Government

DISA STIGs

CIS Benchmarks

Job description

Responsibilities

Peraton is seeking a highly skilled Security Advisor to lead the security engineering, governance, risk and compliance activities for a mission critical systems contract with the federal government. This role oversees day to day operational security, ensures adherence to federal cybersecurity and privacy requirements, and drives continuous security improvement across O&M and system enhancement workstreams. This position partners with program leadership and operations teams to maintain Authority to Operate (ATO), safeguard Protected Health Information (PHI), and deliver reliable, compliant services at scale.

Duties and Responsibilities:

• Own the security architecture and control implementation across application, infrastructure, and cloud layers, aligned with NIST SP 800 53 control baselines, FIPS 199/200 categorization, and CMS security policies.
• Drive vulnerability management (scan triage, remediation SLAs, patch governance) and configuration baselines (e.g., DISA STIGs, CIS Benchmarks, SCAP).
• Compliance, Risk Management Framework (RMF) and Audit Readiness
• Lead end to end Risk Management Framework (RMF) activities (NIST SP 800 37), including security categorizations, control tailoring, System Security Plan (SSP), security assessment, POA&M, and continuous monitoring to sustain ATO.
• Ensure compliance with HIPAA Security Rule (45 CFR §164) for PHI, CMS Acceptable Risk Safeguards (ARS), OMB Circular A 130, and HHS policies.
• Coordinate internal/external audits (IG, CMS, third-party assessors), evidence collection, and control testing; maintain impeccable documentation.
• Lead incident response lifecycle for PHI/PII incident reporting: triage, containment, eradication, recovery, forensics coordination, root cause analysis, and required notifications/reporting.
• Manage access control, identity, MFA, privileged access, security vulnerabilities and continuous monitoring dashboards; ensure reliable backup/restore and disaster recovery exercises.
• Enforce data classification, encryption (in transit/at rest), key management, and tokenization aligned with CMS/HHS requirements.
• Contribute to risk registers and monthly status reporting for program security status to present succinct updates to CMS stakeholders.
• Translate complex security concepts into clear, actionable guidance for technical and non technical audiences.
• Collaborate closely with Program Management, Engineering, QA, Operations, and CMS counterparts.
• Contribute to security requirements for contract renewals and new contract bids.

Qualifications

Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD

Basic Qualifications:

• Experience in cybersecurity across engineering, compliance, and operations; 3+ years in security leadership/management on federal programs.
• Proven experience with NIST SP 800 53, RMF (NIST SP 800 37), FIPS 199/200, HIPAA Security Rule, OMB A 130, and CMS policy frameworks (e.g., CMS ARS).
• Hands‑on with SIEM/EDR, vulnerability management, cloud security architectures (AWS GovCloud/Azure Government), network segmentation, zero trust principles, and DevSecOps tooling.
• Strong documentation skills (SSP, IS RA, SAR, POA&M, Contingency Plans, runbooks, playbooks) and audit engagement.

Preferred Qualifications:

• Certifications: CISSP, CISM, CAP, CCSP, CASP+, Security+, or equivalent.
• Cloud security certs (e.g., AWS Security Specialty, Azure Security Engineer Associate).
• Experience with TIC 3.0, NIST SP 800 63 (digital identity), NIST SP 800 30 (risk assessment), configuration baselines (DISA STIGs/CIS), and FedRAMP-aligned controls.
• Background in large‑scale healthcare/Medicare environments and PHI/PII safeguarding.
• Familiarity with continuous ATO, automated compliance (policy‑as‑code), and modern IaC pipelines.
• Must be US Citizen
• Must be able to obtain a Public Trust clearance
• Problem‑solving mindset with the ability to take initiative and work independently.
• Comfortable in a fast‑paced, iterative development environment.
• Experience working with the federal government. Particularly with Center for Medicare and Medicaid Services (CMS).

Peraton Overview

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

Target Salary Range

$104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

EEO

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.